+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Deface] (More like a deletion really) (/showthread.php?tid=2442479)
[Deface] (More like a deletion really) - anonymous_bdc - Apr 27, 2012
Deleted their products for sale, and added this on the only page that I could really edit.
Code
http://www.signwaves.co.uk/content/Print🤝
* - Natalie Portman - Apr 27, 2012
GG.
Next time try using XSS to deface it, like using the following codes as the name for the product, or the description.
Code
<script>window.location = "http://www.yourdefacepage.com"</script>Code
<meta http-equiv="refresh" content="0; url=http://www.yourdefacepage.com">* - anonymous_bdc - Apr 27, 2012
(Apr 27, 2012 09:59 PM)Envyy Wrote: GG.
Next time try using XSS to deface it, like using the following codes as the name for the product, or the description.
Or, if script tags are blocked:Code<script>window.location = "http://www.yourdefacepage.com"</script>
Code<meta http-equiv="refresh" content="0; url=http://www.yourdefacepage.com">
I tried using the <meta http-equiv="refresh" content="0; url=http://www.yourdefacepage.com"> code for a redirection deface, it didnt work. The site has a weird HTML editing program like PHPnuke used to have, it doesnt save stuff properly.
Ill try the <script>window.location = "http://www.yourdefacepage.com"</script> one now, theres a page called home / products. See if that works.
* - Phizo - Apr 27, 2012
(Apr 27, 2012 09:59 PM)Envyy Wrote: GG.
Next time try using XSS to deface it, like using the following codes as the name for the product, or the description.
Or, if script tags are blocked:Code<script>window.location = "http://www.yourdefacepage.com"</script>
Code<meta http-equiv="refresh" content="0; url=http://www.yourdefacepage.com">
It's not really XSS if you're able to edit the files.
* - Natalie Portman - Apr 28, 2012
(Apr 27, 2012 11:36 PM)Phizo Wrote: It's not really XSS if you're able to edit the files.
Well, it is, considering that XSS stands for Cross-Site-Scripting.
You are scripting between sites; therefore, XSS?
It's just persistent.
Correct me if I'm wrong,
- Envyy
* - orunu - Apr 28, 2012
(Apr 28, 2012 01:09 AM)Envyy Wrote: Well, it is, considering that XSS stands for Cross-Site-Scripting.
You are scripting between sites; therefore, XSS?
It's just persistent.
Correct me if I'm wrong,
- Envyy
i would say if your editing the page directly its just normal JS and all that if your doing it via comment/status box ect.. then its xss
* - Phizo - Apr 28, 2012
(Apr 28, 2012 01:09 AM)Envyy Wrote: Well, it is, considering that XSS stands for Cross-Site-Scripting.
You are scripting between sites; therefore, XSS?
It's just persistent.
Correct me if I'm wrong,
- Envyy
Here is how I see it.
It's not a cross site scripting vulnerability because there is no vulnerability to begin with. Anyone can write a page that contains Javascript (or otherwise) inside it and upload it, that just makes it a page, it's not a vulnerability at all.
Also, you aren't "scripting between sites", that doesn't make any sense.
In respone to this:
Quote:Next time try using XSS to deface it, like using the following codes as the name for the product, or the description.
The correct terminology would be "Next time try using Javascript or HTML to redirect the current page to another page."
You aren't defacing, you're redirecting to another page.
Definition of deface:
Spoil the surface or appearance of (something), e.g., by drawing or writing on it.
You're not really spoiling the surface of it, you're just redirecting them.
Hope this helps.
* - Project13 - Apr 28, 2012
scripting between sites bahahahaha, and Phizo is right, you can't deface with XSS, you can only redirect, unless you use XSS to get to the admin panel