escalation666 Posted December 4, 2006 Report Share Posted December 4, 2006 observ ca se mai practica hidden forms care accepta si au incredere in inputul userilor...un exemplu este acest shop iar'>http://shop.earlyholdens.com/iar aici este un screen in care incercam sa cumpar un produs cu 1 dolar (si care evident costa mult mai mult)http://img124.imageshack.us/img124/399/screen1bmplp1.png Quote Link to comment Share on other sites More sharing options...
buRn Posted December 4, 2006 Report Share Posted December 4, 2006 dar nu inteleg ce caut la exploituri !? Quote Link to comment Share on other sites More sharing options...
Guest flama Posted December 5, 2006 Report Share Posted December 5, 2006 StreSs wrote: dar nu inteleg ce caut la exploituri !? este un vuln ... merge ... unde vroiai sa il puna la xss ? Props esca Quote Link to comment Share on other sites More sharing options...
buRn Posted December 5, 2006 Report Share Posted December 5, 2006 stiu ca este o vulnerabilitate ! In al doilea rand Majoritate nu situ chesta cu "disable form" deaia am zis ! trebea sa le-o zica la cei care nu stiu ! Quote Link to comment Share on other sites More sharing options...
crystygye Posted December 5, 2006 Report Share Posted December 5, 2006 am o intrebare.daca ai facut chestia aia cu un dolar, ai primit coletu si ai platit doar 1 dolar? sau au facut verificari si ti-a tras din cc cat a trebuit? Quote Link to comment Share on other sites More sharing options...
escalation666 Posted December 5, 2006 Author Report Share Posted December 5, 2006 este doar un PoC...n-am continuat cu procesarea comenzii...si oricum n-as fi platit un dolar australian...mai era si shippingul de 30 de $...care vrea sa incerce...n-are decat Quote Link to comment Share on other sites More sharing options...
crystygye Posted December 5, 2006 Report Share Posted December 5, 2006 intrebasem ca chestie.ca am citit despre asta pe un forum sau site acum mai multa vreme.si chiar eram curios daca a cumparat cineva, si chiar a mers (primit coletu) Quote Link to comment Share on other sites More sharing options...
4n4rchyl04d3r Posted December 17, 2006 Report Share Posted December 17, 2006 cat ai platit,dk ai platit 1$ ma sinucid Quote Link to comment Share on other sites More sharing options...
ENCODED Posted December 17, 2006 Report Share Posted December 17, 2006 4n4rchyl04d3r wrote: cat ai platit,dk ai platit 1$ ma sinucid 1+30 = 31 $ Quote Link to comment Share on other sites More sharing options...
4n4rchyl04d3r Posted December 17, 2006 Report Share Posted December 17, 2006 Quote Link to comment Share on other sites More sharing options...
