Fugitif
03.12.2007, 02:39
To be more precise our link is http://finance.google.com
Ok..My XSS alert is here:
http://finance.google.com/finance/portfolio?action=add&hash
How you see in the screen we need authentication.
http://funkyimg.com/u/48650google1JPG.jpg
Good,I go inside with my account and now I try to add something on my
Portofolio. I try to add something like this
"><script>alert(/XSS/)</script> OR: like this "><script>alert(document.cookie)</script> :)
http://funkyimg.com/u/32647google2JPG.jpg
After I have put that string and I press the key "Add to portofolio" we
can see the surprise
http://funkyimg.com/u/73997google3JPG.jpg
That's all.
Ok..My XSS alert is here:
http://finance.google.com/finance/portfolio?action=add&hash
How you see in the screen we need authentication.
http://funkyimg.com/u/48650google1JPG.jpg
Good,I go inside with my account and now I try to add something on my
Portofolio. I try to add something like this
"><script>alert(/XSS/)</script> OR: like this "><script>alert(document.cookie)</script> :)
http://funkyimg.com/u/32647google2JPG.jpg
After I have put that string and I press the key "Add to portofolio" we
can see the surprise
http://funkyimg.com/u/73997google3JPG.jpg
That's all.