[mr.good]

So, it's simple.

There are 2 XSS on some website, and I cannot inject it, so I need some help.
It looks like this:

Code:

1st one: http://www.website.tld/xxxxx.php?=xxxXXXyy=Xyy%20Xaaaaaa&xx_xxxx=%22%20onmouseover%3dprompt%28978061%29%20bad%3d%22

Code:

2nd: http://www.website.tld/xxxxx.php?=xxxXXXyy=Xyy%20Xaaaaaa&xx_xxxx=%22%20onmouseover%3dprompt%28977795%29%20bad%3d%22

The problem is that I cannot discover where /or/ how to / inject in.

Knowing that can be injected with javascript (by "default"), I am just asking for a method help, if possible.
I am not so great with XSS's.

[mrsenrich]

try some like that
http://www.website.tld/xxxxx.php?=<scrip...)</script>

[Anima Templi]

Just forget it, if you have an "OnMouseOver" alert, the chance it will work is near 0%. By the way, blackhat activity are not allowed on this forum. we are an ethical hacking forum.

[1llusion]

When you execute the script, look inside the source of the webpage. Search for the injection and from there you can create the vector.

If you would post the part of source where the vector is injected, we could help you a bit more (just the piece of code, not whole)

Just forget it, if you have an "OnMouseOver" alert, the chance it will work is near 0%. By the way, blackhat activity are not allowed on this forum. we are an ethical hacking forum.

He didn't provide a link to the website so it could be considered non-black hat. He may be just pentesting his website or asking generally, these kind of questions are allowed

[muhammad fakir]

Hey,

Black hat not all of them are bad please understand...
Some of them doing this because of a reason.. And some of black hat do this for fun and for skills..
Please dont look down to them we are here to learn, share And teach...pls...

[Anima Templi]

When you execute the script, look inside the source of the webpage. Search for the injection and from there you can create the vector.

If you would post the part of source where the vector is injected, we could help you a bit more (just the piece of code, not whole)

Just forget it, if you have an "OnMouseOver" alert, the chance it will work is near 0%. By the way, blackhat activity are not allowed on this forum. we are an ethical hacking forum.

He didn't provide a link to the website so it could be considered non-black hat. He may be just pentesting his website or asking generally, these kind of questions are allowed

I was not saying that what he was doing is blackhat activity, but it is fairly close to it. Therefor i would just warn him

Hey,

Black hat not all of them are bad please understand...
Some of them doing this because of a reason.. And some of black hat do this for fun and for skills..
Please dont look down to them we are here to learn, share And teach...pls...

Blackhat activity is not good at all. Do blackhat activity for fun? That is surely a bad thing that they hurt other people for fun! For skills...you can also gain skills with setting up your own lab and test on that, and that is also legal.

[mr.good]

Thanks all.
And, 1llusion, yes it is my website and I was just checking if it is safe or it can be dangerous, as if it is safe, then I do no have reason to worry about. Thanks again.