[Asuna_mybb_import7736]

Hello all reading this!

Me and 1llusion had this conversation on facebook, where we discussed what the best and funniest vulnerabillity are.

He stated, that it's much more fun to hunt for XSS, since allmost all sites has it. But I can't see why this is fun..There's no challenge in that..
But SQLi! If you find it, you have control of the site!

So what do you think? XSS, SQLi or a 3. vulnerabillity?
What's your favourit vuln?

[Nailo]

xss is easier and SQLi takes a longer time to find so SQLI just for the timewise

[Anima Templi]

xss is easier and SQLi takes a longer time to find so SQLI just for the timewise

If you look for xss on big sites it is pretty fun and challenging. On the other side I found sqli pretty easy. I think everyone have their own opinion about it. I can not see why you find xss easier than sqli? They are pretty most easy if you actually knows how to use them.

For the question they are pretty most really powerful and useful on their own way. But I do personally like xss and find it really fun.

[1234hotmaster]

XSS is fun, like your editing the current page, and SQLi is a challenge, editing the mysql_fetch_query's Syntax to return the stuff you want instead of the original MySQL query

[Raz0r]

I've only done SQLi, I am trying to find a good tutorial for XSS. I honestly don't even know where to start TBH.
SQLi is easy wants your find a vuln. I use SQLmap so it takes me 5 min to find the admin login.

[Solixious]

I find both of them to be great.. We shouldn't compare them to each other. But if a choice was given to me, I would say XSS is more fun.

[Anima Templi]

I've only done SQLi, I am trying to find a good tutorial for XSS. I honestly don't even know where to start TBH.

If you are unsure about where to start with xss you could check out my thread.
http://www.hackcommunity.com/Thread-Basic-xss-tutorial

[Shining White]

SQL injection is more difficult and much hard work with diffent type of DBs like MySQL, Oracle, Microsoft Access, IBM DB2, SQLite ,PostgreSQL, Microsoft SQL Server, etc
and different type of attacking such as boolean-based blind, time-based blind, error-based, UNION query, etc if have

Connecting to the DB , Search for tables , Hash cracking , if need uploading shell and rooting i feel much fun of course , its Hard work

otherwise Cross Site Scripting is Messing around injecting HTML , JS like codes with its more fun with Hijacking the DNS , Sessions
and playing with i say ,

as Solixious said We shouldn't compare them to each other . but XSS is more fun otherwise owning the dump

[1llusion]

I like more XSS because its more transparent. With SQLi if you make a mistake, you don't have to get exact reason why it doesn't work. The actual syntax runs on the server therefore for you, as a client, most of the process is invisible.

While for XSS, the injection runs on your computer (the client) and you see exactly what goes on. You can have a pretty precise guess what is happening on the server side when reading the output of some page. Also XSS isn't considered as high risk as SQLi (I say the risk levels are same! but whatever...) so you don't really need to cover yourself so much. And if you report it, you don't look so suspicious. (Honestly, would you be more suspicious of a guy reporting you how he hacked into your database or about a guy showing you how to pop-up an alert box?)

[Raz0r]

I've only done SQLi, I am trying to find a good tutorial for XSS. I honestly don't even know where to start TBH.

If you are unsure about where to start with xss you could check out my thread.
http://www.hackcommunity.com/Thread-Basic-xss-tutorial

I checked it out, and bookmarked it so I can practice for educational purposes.