XSS On Ebay.com
 

I am still Fugitif and now I want to show you how can work one vulnerable XSS Alert Bug on Ebay.com.
To be more precise our link now is http://togo.ebay.com

Ok..My XSS alert can be found here http://togo.ebay.com/affiliates/create/


http://funkyimg.com/u/20862ebay_1JPG.jpg


I go to select one version and I crush above


http://funkyimg.com/u/89922ebay_2JPG.jpg


and immediately later click "I WANT THIS ONE"


In the square where asks FOR "ID" I put some string like this


http://funkyimg.com/u/82647ebay_3JPG.jpg


and click "Browse"


http://funkyimg.com/u/36366ebay_4JPG.jpg


Now we cannot do anything else other than to use the search with our magic string


My Result ? !


http://funkyimg.com/u/95003ebay_5JPG.jpg



That's all .... have fun ppl :D


/Fugitif

And what's the exact use of all these operations?

Well passive XSS, but the JavaScript code is in the POST parameters, so the victim must enter the needed code by itself?
Think it's useless...

nice dude :)

to Fugitif:
it is does not work already...

works for me

hmmmm. I thought ebay have safe protect :)

really?!
what browser did u use?

U can try with Mozilla Firefox some string like this one:

mozilla firefox