+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: XSS CNN vector, need explanation please (/showthread.php?tid=2848821)
XSS CNN vector, need explanation please - unnamednoob - Sep 8, 2012
edition.cnn.com/search/index.html?sortBy=date&primaryType=mixed&source=money&query="><iframe+onload%3Dalert%28%2FXSS%2F%29>
i don't understand how this work, im not the best at XSS, if someone mind explaining that for me? :)
* - KernelMode - Sep 8, 2012
I'm pretty sure this is how it would work... :L
"> was used to escape the value="search here".
<iframe creates an iframe.
onload= onload is when the page loads.
alert(/XSS/)> displays the message box and closes the tag.
* - Desmolicious - Sep 8, 2012
That XSS was patched awhile ago. XD Same with money.cnn.com
* - unnamednoob - Sep 8, 2012
(Sep 8, 2012 06:39 PM)Affine Wrote: I'm pretty sure this is how it would work... :L
"> was used to escape the value="search here".
<iframe creates an iframe.
onload= onload is when the page loads.
alert(/XSS/)> displays the message box and closes the tag.
yea, i though so too, but what confussed me is when i only typed "><script>alert(0)</script> it didn't work
(Sep 8, 2012 06:47 PM)Desmolicious Wrote: That XSS was patched awhile ago. XD Same with money.cnn.com
still works for me O_o, are u sure?
* - Jae - Sep 8, 2012
(Sep 8, 2012 06:47 PM)Desmolicious Wrote: That XSS was patched awhile ago. XD Same with money.cnn.com
It's obviously not patched if it's still functioning. 😅
* - Desmolicious - Sep 8, 2012
(Sep 8, 2012 07:16 PM)Jewel Wrote: It's obviously not patched if it's still functioning. 😅D: It doesn't Function for any of my webBrowsers.. @Failure?
* - Jae - Sep 8, 2012
(Sep 8, 2012 07:22 PM)Desmolicious Wrote: D: It doesn't Function for any of my webBrowsers.. @Failure?
Strange. Check the URL hasn't messed up, it's working fine for me.
* - Desmolicious - Sep 8, 2012
(Sep 8, 2012 07:25 PM)Jewel Wrote: Strange. Check the URL hasn't messed up, it's working fine for me.Alright, Maybe there's an error in the Script i'm using.
* - ownster - Sep 8, 2012
This is cooler :L
http://edition.cnn.com/search/index.html?sortBy=date&primaryType=mixed&source=money&query=%22%3E%3Ch1%3ETROLL,%20lol%20what%20a%20fail%20page%20XD%3C/h1%3E%3Cmarquee%3E
:D, Anyways they should fix this lmao.
* - JrMn - Sep 9, 2012
(Sep 8, 2012 07:22 PM)Desmolicious Wrote: D: It doesn't Function for any of my webBrowsers.. @Failure?
Chrome has a XSS filter against reflected (or non-persistant) XSS.