xymon
+ Reply to Thread
Results 1 to 10 of 10

Thread: The best programming language - Power

Hybrid View

  1. 11-05-2006, 08:40 PM #1
    Moonbat
    Moonbat is offline Registered User
    Send a message via MSN to Moonbat
    Join Date
    Sep 2006
    Posts
    1,649

    hmm

    I'm gonna hope this is it.

    <img src="javascript:alert("This?")">

    Guess not, maybe...

    <img src=javascript:alert("This?")>

    Hmm... no....

    <img src="javascript:alert('This?')">

    Gah, last try, pleaseohplease work...

    <img src=alert("Hello")>
    -----------------------------------------------
    Nvm, theses guys are smart, they change the output to the webpage so it looks like this

    <!-- message -->
    <div id="post_message_*4725">I'm gonna hope this is it.<br />
    <br />
    &lt;img src=&quot;javascript<b></b>:alert(&quot;This?&quot&quot;&gt;<br />
    <br />
    Guess not, maybe...<br />
    <br />
    &lt;img src=javascript<b></b>:alert(&quot;This?&quot&gt;<br />
    <br />
    Hmm... no....<br />
    <br />
    &lt;img src=&quot;javascript<b></b>:alert('This?')&quot;&gt;<br />
    <br />
    Gah, last try, pleaseohplease work...<br />
    <br />
    &lt;img src=alert(&quot;Hello&quot&gt;</div>
    <!-- / message -->
    I guess the filter replaces my <,>," with the HTML character entity value. I've seen some forums that don't do this, therefore are vulnerable to injection. They would see the alert come up.
    Last edited by Moonbat; 11-05-2006 at 08:56 PM.
    Reply With Quote Reply With Quote
  2. 11-06-2006, 04:34 AM #2
    LapraS
    LapraS is offline Registered User
    Join Date
    Nov 2006
    Posts
    3
    I will try to post the profile hack I have scripted as soon as possible.
    As for Session ID I was referring to the *2 digits cookie such as:
    edb0e8665db4e*042fe0*76a8*aade*6
    Basically what I did was find a free webhost, upload 4 files, namely; cookies.txt
    js.php, js.js.
    In my profile I posted a link to my webhost. Whenever someone viewed my profile his/her Session ID was shown on my webhost. I simply copied this Session ID into the Anec Cookie editor...
    I submitted;
    Name: PHPSESSID
    Path: [url]www.bootleggers.us[/url]
    And the Session ID
    I opened Mozilla Firefox and browsed for [url]www.bootleggers.us/news.php[/url].
    Last edited by LapraS; 11-06-2006 at 04:45 AM.
    Reply With Quote Reply With Quote
  3. 11-06-2006, 11:06 AM #3
    Ezekiel
    Ezekiel is offline Registered User
    Join Date
    Sep 2005
    Posts
    2,050
    Quote Originally Posted by Moonbat
    I'm gonna hope this is it.

    <img src="javascript:alert("This?")">

    Guess not, maybe...

    <img src=javascript:alert("This?")>

    Hmm... no....

    <img src="javascript:alert('This?')">

    Gah, last try, pleaseohplease work...

    <img src=alert("Hello")>
    -----------------------------------------------
    Nvm, theses guys are smart, they change the output to the webpage so it looks like this



    I guess the filter replaces my <,>," with the HTML character entity value. I've seen some forums that don't do this, therefore are vulnerable to injection. They would see the alert come up.
    No, the bug is in the top right search box for the actual site. If you enter this into it, you get the popup:

    </title></head><body><script type="text/javascript">alert("XSS");</script>

    As for bugs in widely used forum scripts; they're rare. In forums like vBulletin, they're non-existent (most of the the time).
    Reply With Quote Reply With Quote
  4. 11-30-2006, 04:40 PM #4
    Rase
    Rase is offline Registered User
    Join Date
    Nov 2006
    Posts
    5
    Javascript + Advanced html Ftw.

    Also C Is ok.
    Reply With Quote Reply With Quote
+ Reply to Thread
« Previous Thread | Next Thread »

Similar Threads

  1. Can anyone solve this question in C programming Language?
    By Stella Richards in forum Programming
    Replies: 3
    Last Post: 03-14-2016, 01:04 AM
  2. C++ and Java are user defined programming language.
    By Aayus in forum Programming
    Replies: 0
    Last Post: 07-05-2012, 09:11 AM
  3. What's the most popular web programming language?
    By slicegan2 in forum Programming
    Replies: 14
    Last Post: 12-23-2010, 03:32 AM
  4. Programming language choice: Java
    By new_rez in forum General discussion
    Replies: 1
    Last Post: 08-06-2008, 04:20 PM
  5. Programming Language for Writing Drivers?
    By loopers in forum Internet Privacy
    Replies: 2
    Last Post: 01-16-2003, 05:37 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts

Forum Rules