Hack Forums
[XSS] E-HACKING NEWS Vulnerable to Cross Site Scripting [XSS] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [XSS] E-HACKING NEWS Vulnerable to Cross Site Scripting [XSS] (/showthread.php?tid=2131454)

[XSS] E-HACKING NEWS Vulnerable to Cross Site Scripting [XSS] - gaccount - Jan 21, 2012

Hey guys now this time i found a vulnerability in http://www.ehackingnews.com/

here is the proof:

http://www.ehackingnews.com/2012/01/reflected-xss-vulnerability-in.html


[Image: HC2rA.png]

REPORTED



* - Dagnow - Jan 21, 2012

Wtf is this :/ Always message ttt. I hate that

* - gaccount - Jan 21, 2012

(Jan 21, 2012 06:32 AM)Dagnow Wrote:  Wtf is this :/ Always message ttt. I hate that

What happened dude, Don't you like this !!

* - dwd - Jan 21, 2012

congratulation keep going try to get the root :)

* - gaccount - Jan 21, 2012

(Jan 21, 2012 08:53 AM)wingb0t Wrote:  he probably doesnt know what xss is... 😕

but nice find man :)

was it simply <script>alert('XSS');</script> or did you have to use some "tricks" ? :D

It was not not <script>alert("XSS")</script> it was something else....:)

* - agentannon - Jan 21, 2012

Nice find, XSS has always been hard for me.

* - gaccount - Jan 21, 2012

(Jan 21, 2012 11:27 AM)agentannon Wrote:  Nice find, XSS has always been hard for me.

Previously it was hard for me also but i tried my level best and now you can see the results !!

* - zer0pwn - Jan 21, 2012

I found this yesterday, it's patched.
But the vector is:

<img src=1 onerror=alert(1);>

* - Acunetix - Jan 21, 2012

nice find men keep it up

and try to have another better like this

* - gaccount - Jan 22, 2012

(Jan 21, 2012 12:09 PM)Zer0Pwn Wrote:  I found this yesterday, it's patched.
But the vector is:

<img src=1 onerror=alert(1);>

I have not used this vector and when i informed the owner he patched it that time only..:)

(Jan 21, 2012 01:42 PM)Acunetix Wrote:  nice find men keep it up

and try to have another better like this

Thanks and sure i will try my level best !! 🤗

* - worldblackstar - Jan 22, 2012

<img src=1 onerror=alert(1);> This code also worked. The vulnerability allows html tags to execute.

* - gaccount - Jan 22, 2012

(Jan 22, 2012 05:19 AM)worldblackstar Wrote:  <img src=1 onerror=alert(1);> This code also worked. The vulnerability allows html tags to execute.

Maybe because the vulnerability has been patched....