+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Persistent XSS in chess.com (/showthread.php?tid=5121669)
Persistent XSS in chess.com - Kyle1995 - Jan 4, 2016
Lol I wasn't even pentesting the site, first section (under videos->comments) I typed in <a> and it disappeared and I was like ohhh shit.
Its a bunch of pure php and jquery api calls, unfortunately they do escape quotes, but not single quotes lol, who knows how many vulnerabilities are on there.
this was from the app btw, horribly coded.
* - Gee4rce - Jan 4, 2016
Wouldn't be surprised if there is even more than XSS as the coding seems outdated.
Code
http://www.chess.com/photos/?keyword=<scr ipt>alert('Hello..')</scr ipt>Cheers, Gee.
* - SIM-2914565 - Jan 7, 2016
hahaha i made it: bit .ly/1OPTGXY
(BTW bitly is also XSS vulnerable.. You can paste some codes in there, it only works on Client-side)
To make this done you have to do: https :// google .com/?q=YOUR_XSS_CODE