+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.li/Forum-Website-Server-Hacking)
+--- Thread: XSS on website, but how :/ (/Thread-XSS-on-website-but-how)
XSS on website, but how :/ - mr.good - 09-06-2012
So, it's simple.
There are 2 XSS on some website, and I cannot inject it, so I need some help.
It looks like this:
Code:
1st one:
http://www.website.tld/xxxxx.php?=xxxXXXyy=Xyy%20Xaaaaaa&xx_xxxx=%22%20onmouseover%3dprompt%28978061%29%20bad%3d%22Code:
2nd:
http://www.website.tld/xxxxx.php?=xxxXXXyy=Xyy%20Xaaaaaa&xx_xxxx=%22%20onmouseover%3dprompt%28977795%29%20bad%3d%22The problem is that I cannot discover where /or/ how to / inject in.
Knowing that can be injected with javascript (by "default"), I am just asking for a method help, if possible.
I am not so great with XSS's.
RE: XSS on website, but how :/ - mrsenrich - 09-09-2012
try some like that
http://www.website.tld/xxxxx.php?=<script>alert(document.cookie)</script>
RE: XSS on website, but how :/ - Anima Templi - 09-09-2012
Just forget it, if you have an "OnMouseOver" alert, the chance it will work is near 0%. By the way, blackhat activity are not allowed on this forum. we are an ethical hacking forum.
RE: XSS on website, but how :/ - 1llusion - 09-09-2012
When you execute the script, look inside the source of the webpage. Search for the injection and from there you can create the vector.
If you would post the part of source where the vector is injected, we could help you a bit more
(just the piece of code, not whole)(09-09-2012, 04:00 PM)Anima Templi Wrote: Just forget it, if you have an "OnMouseOver" alert, the chance it will work is near 0%. By the way, blackhat activity are not allowed on this forum. we are an ethical hacking forum.
He didn't provide a link to the website so it could be considered non-black hat. He may be just pentesting his website or asking generally, these kind of questions are allowed
RE: XSS on website, but how :/ - muhammad fakir - 09-10-2012
Hey,
Black hat not all of them are bad please understand...
Some of them doing this because of a reason.. And some of black hat do this for fun and for skills..
Please dont look down to them we are here to learn, share And teach...pls...
RE: XSS on website, but how :/ - Anima Templi - 09-10-2012
(09-09-2012, 11:02 PM)1llusion Wrote: When you execute the script, look inside the source of the webpage. Search for the injection and from there you can create the vector.
If you would post the part of source where the vector is injected, we could help you a bit more
(09-09-2012, 04:00 PM)Anima Templi Wrote: Just forget it, if you have an "OnMouseOver" alert, the chance it will work is near 0%. By the way, blackhat activity are not allowed on this forum. we are an ethical hacking forum.
He didn't provide a link to the website so it could be considered non-black hat. He may be just pentesting his website or asking generally, these kind of questions are allowed
I was not saying that what he was doing is blackhat activity, but it is fairly close to it. Therefor i would just warn him
(09-10-2012, 03:34 AM)muhammad fakir Wrote: Hey,
Black hat not all of them are bad please understand...
Some of them doing this because of a reason.. And some of black hat do this for fun and for skills..
Please dont look down to them we are here to learn, share And teach...pls...
Blackhat activity is not good at all. Do blackhat activity for fun? That is surely a bad thing that they hurt other people for fun! For skills...you can also gain skills with setting up your own lab and test on that, and that is also legal.
RE: XSS on website, but how :/ - mr.good - 09-10-2012
Thanks all.
And, 1llusion, yes it is my website and I was just checking if it is safe or it can be dangerous, as if it is safe, then I do no have reason to worry about. Thanks again.