+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Vulnerabiltiy in Nasa (/showthread.php?tid=4149071)
Vulnerabiltiy in Nasa - myt9h - Apr 2, 2014
http://vmo.nasa.gov/vxo/metadata.php?id=wtf+is +this+?
🙃🙃
* - SohnGottes - Apr 2, 2014
looks to me like it just outputs whatever you put for id. how is this a vulnerability? the output goes through htmlentities()... 🙂
* - Ρain - Apr 2, 2014
Idk about this but I do know NASA has a ton of XSS vulns
* - myt9h - Apr 2, 2014
aww it should not output though in manner like that , reported already to nasa ,but still not fixed
* - Cubs - Apr 2, 2014
I am such a l33t haxor
http://vmo.nasa.gov/vxo/metadata.php?id=cubs+was%20+here+?
* - lillix - Apr 2, 2014
This isn't an XSS vuln, any HTML script is filtered, you'd at least have to bypass the filter before this is a working vuln.
(Apr 2, 2014 02:34 PM)myt9h Wrote: aww it should not output though in manner like that , reported already to nasa ,but still not fixedlolwat
* - myt9h - Apr 2, 2014
(Apr 2, 2014 02:32 PM)G0dOf4ll Wrote: Idk about this but I do know NASA has a ton of XSS vulns
yeah buddy agree it has lots of xss.....
* - Effexion - Apr 2, 2014
Lol, I thought you had hacked NASA whe9n I read the title. Ohhhhhh O..P.
* - myt9h - Apr 2, 2014
(Apr 2, 2014 02:36 PM)Effexion Wrote: Lol, I thought you had hacked NASA whe9n I read the title. Ohhhhhh O..P.
buddy i just found this worthy ,i share it therefore ......
* - Sʜᴀᴅᴏᴡ Rᴇᴀʟᴍ - Apr 2, 2014
(Apr 2, 2014 02:38 PM)myt9h Wrote: buddy i just found this worthy ,i share it therefore ......
it is almost as worthless as an xss
* - poxoq - Apr 3, 2014
all those "vuln" are honeypots.....
* - Wᴀᴄᴋᴏ - Apr 3, 2014
(Apr 2, 2014 02:40 PM)Sʜᴀᴅᴏᴡ Rᴇᴀʟᴍ Wrote: it is almost as worthless as an xss
I think it's worth less than an XSS. Nothing can even be executed here.
(Apr 3, 2014 09:55 AM)poxoq Wrote: all those "vuln" are honeypots.....
Why the fuck would they have XSS honeypots? Nobody's going to track somebody down for a reflective XSS unless they do something stupid like email Nasa with the link to a cookie stealer or some shit.
* - Th3PonyWizard - Apr 4, 2014
Nasa has more holes than swiss cheese. This one isn't an actual vulnerability although that's arguable. Outputting user input through GET is still a minor risk considering people are retarded enough to fall for Phishing and various SE attempts of which this can be used with.