+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Found XSS Vulnerabilities (/showthread.php?tid=6058464)
Found XSS Vulnerabilities - Perica - Mar 20, 2020
Hello, I recently found XSS vulnerability on a website but i dont know what to do i mean benefit from it.
I can contact owner of the website and tell them. Or i can benefit from it ??
Here is the picture:
https://imgur.com/a/yUF81z6
RE: Found XSS Vulnerabilities - Sitrep - Mar 20, 2020
The XSS-protection header is missing, but that doesn't mean it's vulnerable by default. Have you actually found an entry point where an XSS is launched?
Also, you can benefit in some cases but it's rare and you need to know how to use a stored XSS where you also receive cookies at your end for example.
But the best thing you can do, is to contact the service owner and report the bug if you find one.(then you might get paid as a thanks).
But an online scan result as in your picture wont due, you need a real PoC (Proof Of Concept).
Hope it helped you a bit.
RE: Found XSS Vulnerabilities - SIM-4199941 - Mar 20, 2020
(Mar 20, 2020 05:10 AM)Perica Wrote: Hello, I recently found XSS vulnerability on a website but i dont know what to do i mean benefit from it.
I can contact owner of the website and tell them. Or i can benefit from it ??
Here is the picture:
https://imgur.com/a/yUF81z6
You can use Pixload for hack the website with just an image.. like PNG or JPG
You're a great bug finder 🕵️
RE: Found XSS Vulnerabilities - Perica - Mar 20, 2020
(Mar 20, 2020 04:15 PM)Sitrep Wrote: The XSS-protection header is missing, but that doesn't mean it's vulnerable by default. Have you actually found an entry point where an XSS is launched?
Also, you can benefit in some cases but it's rare and you need to know how to use a stored XSS where you also receive cookies at your end for example.
But the best thing you can do, is to contact the service owner and report the bug if you find one.(then you might get paid as a thanks).
But an online scan result as in your picture wont due, you need a real PoC (Proof Of Concept).
Hope it helped you a bit.
Can i use Burp Suite or smth like that bcs i dont know how to do it manually.
RE: Found XSS Vulnerabilities - Sitrep - Mar 20, 2020
(Mar 20, 2020 06:49 PM)Perica Wrote: Can i use Burp Suite or smth like that bcs i dont know how to do it manually.
You can use burp suite for it yes, but you will have to read about the fundamentals first, to understand what XSS is and how to exploit it.
https://owasp.org/www-community/attacks/xss/
Some manual input will be needed most likely.
RE: Found XSS Vulnerabilities - Perica - Mar 21, 2020
(Mar 20, 2020 08:17 PM)Sitrep Wrote: You can use burp suite for it yes, but you will have to read about the fundamentals first, to understand what XSS is and how to exploit it.
https://owasp.org/www-community/attacks/xss/
Some manual input will be needed most likely.
Thank you, really helped me.