sensi

Ala e in New Topic daca ai observat, daca e old, comunitatile in care am gasit trebuia sa-l fi reparat inainte sa raportez eu;)).

Dupa mai multe mesaje primite, am decis sa public vulnerabilitatile gasite in vBulletin, poate unii o sa se bucure, altii nu. Acesta fiind primul meu exploit, sper sa va placa. Eu zic sa raspandim exploit-ul, facem putina reclama RST-ului. ########################################################################################## # -#-#- vBulletin 4.x.x - Multiple Cross-Site-Scripting Vulnerabilities -#-#- # -#-#- RSTforums.com -#-#- # # # • Exploit Title: vBulletin 4.x.x - Multiple Cross-Site-Scripting Vulnerabilities - Reflected # • Google Dork: "Powered by vBulletin® Version 4.x.x" # • Date: 13.08.2013 # • Exploit Author: Sensi # • Website: RSTforums.com # • Software Link: http://vbulletin.com/ # • Version: vBulletin 4.x.x # • Tested on: Linux & Windows # • Special thanks to: [URL="https://rstforums.com/forum/members/kalash1337/"]Kalash1337 [/URL] # ########################################################################################## # # ### First XSS ### # # Step 1: Go to -> Any post -> Press Editpost(advanced editor) -> Inspect 'title' element source and delete maxlength="85" # (Direct Link:) [url]http://localhost/[/url][path]/editpost.php?p=[post number]&do=editpost # # Step 2: Add a malicious vector on title element. # (Example:) sensisensisensisensisensisensisensisensisensisensisensisensisensisensisensisensisensi"><script>alert(/sensi @ RSTforums.com/);</script> # #________________________________________________________________________________________ #======================================================================================== #---------------------------------------------------------------------------------------- # # ### Second XSS ### # # Step 1: Go to -> Any thread -> Press post new reply(advanced editor) -> Inspect 'title' element source and delete maxlength="85" # (Direct Link:) [url]http://localhost/[/url][path]/newreply.php?p=[post number]&noquote=1 # # Step 2: Add a malicious vector on title element. # (Example:) sensisensisensisensisensisensisensisensisensisensisensisensisensisensisensisensisensi"><script>alert(/sensi @ RSTforums.com/);</script> ########################################################################################## # # # Author will be not responsible for any damage caused! User assumes all responsibility. # # ##########################################################################################

Mai adaug, daca chiar n-ai altceva de facut, poti posta si tutoriale, exploit-uri, tool-uri, poti ajuta membrii noi.

IceImg — ??????? ??????????? http://iceimg.com/i/3a/7f/466ad36fd9.jpg - Link direct

La multi ani!

Felicitari! Niciodata nu e prea tarziu.

La primul XSS persistent ma vezi pe black Nu vreau sa incurajez asta, dar asta e adevarul, pe black scoti mult mai mult.

In primul rand vreau sa-mi cer scuze pentru dublu post! Hello ---------, ([U]vreau sa precizez ca nici nu mi-au scris numele corect[/U]) Thank you for participating in the PayPal Bug Bounty Program. We regret to inform you that your bug submission was not eligible for a bounty as this bug was already discovered by another researcher. Title: [Cross-Site-Scripting] www.paypal.com UID: yx1175uS Thank you for your participation. We take pride in keeping PayPal the safer place for online payment. Thank you, PayPal Security Team XSS-ul era ceva asemanator cu cel care l-am gasit aici, deci slabe sanse sa fi gasit altcineva... MUIE PAYPAL!

Mersi baieti!

Yes, I was logged and thanks.

Teoretic ar trebuii sa primesc 750$

Multumesc!

- Exploit: Paypal.com - Cross Site Scripting - Author: sensi - Browser: Firefox 23.0 - Status: Reported! - P.o.C: Error:

Dupa ce ca-ti ofera gratis, mai si comentezi. Facepalm!

ksfajk aksjfkla

Bine ai venit, sedere placuta! https://www.youtube.com/watch?v=a4I_2GxrQPM

Old style, Firefox. // WTF ?!

La fel

As avea si eu nevoie daca mai e loc ...

La multi ani! , app cati ani ai implinit ?

@The Time, ce versiune de Chrome folosesti?

View image: madar facar

@TheTime, esti 100% sigur ? @Zatarra, nu toti fac ceva pentru rasplata, poate unii vor sa invete/exerseze . @Sweby, daca nu poti face challenge-ul, nu trebuie sa te apuci sa iei omu' la pula. p.s: in 30 min il fac. Un filtru dasta mi-a vandut si mie