Hello there, Hack Forums. I haven't made a tutorial in quite a while, and decided to post one today ^_^. I'm posting a tutorial on a very useful XSS method I discovered (I'm not sure if lots of people know it or not :S). To successfully complete this method, you will need Tamper Data, and Firefox. That's all.

Finding a vulnerability

To successfully exploit this vulnerability, you will need a form that is select only. The form should look like this:

Also, this (obviously) must be on a page where it will save the selection we pick. I usually find these vulnerabilities in a Profile page, where it will say what kind of business you work in. Or what kind of job you do. Now for the next part, we need tamper data. So if you don't have it, go to the mozilla firefox addons home, and search for Tamper Data.

Tamper data is an HTTP Headers editor, so we'll be able to edit what we select in the boxes. Note that not every site is vulnerable, but the site I tested this on is called "F2C.com". It's one of the biggest (popular) sites in the world. And it's worth a lot of points on rankmyhack.com. Anyways, get Tamper data open. But don't start tampering yet. Select the option in the form, then start tampering, and hit "Save". Now on Tamper data, a little box should have appeared. It'll say the link of the request we're tampering. Now, you should see on the right side, what you put in for the form. Edit that to "><script>alert(/XSS/)</script>. Now you're done!

Sorry if this is a disorganized tutorial, hopefully it helped you out with XSS. If you have ANY questions, about XSS, this tutorial, my other tutorials. DO NOT HESITATE to PM me, I will respond to you as soon as I can! I am online a lot, so you should get a reply in the first 10-20 minutes. Enjoy this method, and please reply saying thanks just to keep the thread alive. :)