+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: █▬█ Mediafire.com Persistent XSS [Tut] █▬█ (/showthread.php?tid=1636543)
█▬█ Mediafire.com Persistent XSS [Tut] █▬█ - Numinous - Aug 22, 2011
█▬█ Mediafire Persistent XSS [Tut] █▬█
Mediafire.com suffers from a persistent XSS vulnerability within its file uploads.
After a user has uploaded their file they can change the title of the file.
To something like
Code
<script>alert('Chetan')</script> .txtCheck these Examples:-
http://www.mediafire.com/?37q503pdsda7k3r
OR
http://www.mediafire.com/?kkbrj6h6ou7v335
OR
http://www.mediafire.com/?c49cukaveu195wv
OR
https://hackforums.net/showthread.php?tid=1636543&pid=14941431#pid14941431
OR
https://hackforums.net/showthread.php?tid=1636543&pid=14939567#pid14939567
* - simply_mark - Aug 22, 2011
What are the pros and cons of using this trick mate? I don't understand, sorry I'm noob. :)
* - Galithiel - Aug 22, 2011
(Aug 22, 2011 02:10 AM)simply_mark Wrote: What are the pros and cons of using this trick mate? I don't understand, sorry I'm noob. :)
You can steal premium accounts or make them download another thing, etc...
* - Pseudonym - Aug 22, 2011
Good job finding that. And also nice sharing with other people, I bet that most people wouldn't do it for various reasons whether to want it misuse personally or report it to the admin. On the other hand, haven't you written in other thread something about being ethical?
* - conan_1 - Aug 22, 2011
Seems a good job for me, I have to stop sqli and give some time to xss xD
* - Middle - Aug 22, 2011
Haha wow nice find!
This could come in handy :D
* - Anti-trust - Aug 22, 2011
(Aug 22, 2011 01:37 AM)h4CK-0-1Nd14 Wrote:█▬█ Mediafire Persistent XSS [Tut] █▬█
Mediafire.com suffers from a persistent XSS vulnerability within its file uploads.
After a user has uploaded their file they can change the title of the file.
To something like
Code<script>alert('Chetan')</script> .txt
Check this Example:-
http://www.mediafire.com/?37q503pdsda7k3r
yeahh good job rep +1 Enjoy 😊
* - Ph03.nix - Aug 22, 2011
Wow, awesome find. Thank you very much for this share 🤭
* - Basics. - Aug 22, 2011
That's quite a find, though I think it has been posted before but nontheless good job.
* - D-gravE - Aug 22, 2011
Good job finding that. And also nice sharing with other people,
* - ryonan - Aug 22, 2011
that's so cool man, gonna give this a try
* - ericosman - Aug 22, 2011
nice this will become helpfull :)
hope it wont get fixed
* - Numinous - Aug 22, 2011
Thanx 4 all of you for being stay here and Now i wanna ask one question
How we protect a site from XSS???
* - SuburbanInsanity - Aug 22, 2011
So if you upload a java drive-by jar, you could run it using another random upload directly on mediafire? interesting.
* - Layfon - Aug 22, 2011
hmmm is <script> the only thing we can do>?