+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [TUT] HTMLi [TUT] (/showthread.php?tid=2350367)
Pages: Pages
1
2
[TUT] HTMLi [TUT] - Germans - Mar 29, 2012
A simple tutorial brought to you by Team Ultra Alternative with more to come
![[Image: DO2qi.jpg?1]](https://i.imgur.com/DO2qi.jpg?1)
CODES
Spoiler (Click to View)
Credits to Unloaded and Ammar23 (Team Ultra Alternative)
* - Ariana Grande - Mar 29, 2012
The reason that it's a dead topic on HF is because most, if not all guestbooks have been patched and/or hacked. HTMLi is a very hard vulnerability to come by nowadays.
* - Germans - Mar 29, 2012
(Mar 29, 2012 06:25 PM)Ariana Grande Wrote: The reason that it's a dead topic on HF is because most, if not all guestbooks have been patched and/or hacked. HTMLi is a very hard vulnerability to come by nowadays.This is true, but many websites if you have hacked the admin account, supply a place to enter data, or something and can be exploited. You are right, and finding HTMLi vulns also very often involves other hacking also. I just found an HTMLi vulnerable area the other day in the admin panel of a site.
* - FastFive - Mar 29, 2012
so what exactly is the difference between persistent xss and htmli? xss is not limited to javascript you know
if you ask me it is the same thing
good tutorial though, and these are still around but mostly as random finds. i found one of these on a chinese government site....
* - Germans - Mar 29, 2012
(Mar 29, 2012 06:42 PM)FastFive Wrote: so what exactly is the difference between persistent xss and htmli? xss is not limited to javascript you knowLol, Chinese government site, well they are very similar to persistant XXS, you're right.
if you ask me it is the same thing
good tutorial though, and these are still around but mostly as random finds. i found one of these on a chinese government site....
* - zer0pwn - Mar 29, 2012
It's unseen because people can't even tell the difference between Persistent XSS and HTMLi. People like you -facepalm-. HTMLi is injecting HTML not javascript. Using an alert would be javascript. HTML would be more like:
Code
<h1> OHAIDER! </h1>* - Germans - Mar 29, 2012
(Mar 29, 2012 07:24 PM)Zer0Pwn Wrote: It's unseen because people can't even tell the difference between Persistent XSS and HTMLi. People like you -facepalm-. HTMLi is injecting HTML not javascript. Using an alert would be javascript. HTML would be more like:I know, with HTMLi you can also edit smaller things like adding your mark to the footer, or something else. It can be used to make smaller or insignificant changes.
Code<h1> OHAIDER! </h1>
* - live fast - Mar 29, 2012
(Mar 29, 2012 07:24 PM)Zer0Pwn Wrote: It's unseen because people can't even tell the difference between Persistent XSS and HTMLi. People like you -facepalm-. HTMLi is injecting HTML not javascript. Using an alert would be javascript. HTML would be more like:
Code<h1> OHAIDER! </h1>
So, if you exploit a vulnerability to use JavaScript to redirect a page, it is an XSS, but if you use HTML to redirect a page, it is considered an HTMLi?
Weird. As far as I'm concerned, the only difference between "HTMLi" and XSS is the name.
* - ℛℛℛoooℛℛℛ - Mar 29, 2012
You made a Mistake on the first box, its XSS not XXS, nice, and your not bringing HTMLi back, its always been around.
EDIT: Ooh never mind you keep referring to it as XXS, noob 🤐
-Chosen-
* - The Ion - Mar 29, 2012
i did only one site for html injection thats a famous actor site
* - Techie - Mar 29, 2012
Wow. So many noobs on HF.
http://en.wikipedia.org/wiki/Code_injection
Quote:HTML-script injection (cross-site scripting)
HTML/Script injection is a popular subject, commonly termed "Cross-Site Scripting", or "XSS". XSS refers to an injection flaw whereby user input to a web script or something along such lines is placed into the output HTML, without being checked for HTML code or scripting.
The two basic types are as follows:
Active (Type 1)
This type of XSS flaw is less dangerous, as the user input is placed into a dynamically generated page. No changes are made on the server.
Passive (Type 2)
This type is more dangerous, as the input is written to a static page, and as such, is persistent.
* - BeggFoMercy - Mar 30, 2012
Dude , I seen the same pics in the same name TUT on the Web Tutorials Section , Did you copy it ?
* - Great Prosperity - Mar 30, 2012
Actually a site vulnerable to HTML has the potential to be vulnerable to xss by using different vectors like <img SRC to execute JavaScript.
* - MaX0xf - Mar 30, 2012
What the fuck is XXS?
Dude, seriously.
Btw, just like Techy said.
* - Germans - Mar 30, 2012
(Mar 29, 2012 09:14 PM)-Chosen- Wrote: You made a Mistake on the first box, its XSS not XXS, nice, and your not bringing HTMLi back, its always been around.OK, sorry it was an accident, I know what it stands for just typed it wrong. Cross (X) Site (S) Scripting (S)
EDIT: Ooh never mind you keep referring to it as XXS, noob 🤐
-Chosen-