[PingByte1337]

Hey Guys,

i try a lot of Websecurity.

Now i found a XSS but what can i now do? Standard Scripts with Alert works but how i got Shell Commands like "whoami" or can login with admin (tried SQLi).

How can help me? thx

[Beladonis]

XSS is a client-sided attack vector, you can't use server-sided shell commands like "whoami".

[G.P.D.]

There is two options : white and black hat option.

Black : You can try to use that vulnerability to steal cookies from the administrator.
White : Inform the administrator that there is a security issue on his website.

[Bladabindi]

There is two options : white and black hat option.

Black : You can try to use that vulnerability to steal cookies from the administrator.
White : Inform the administrator that there is a security issue on his website.

Great exaplined

[gemini220]

look into beef, then goto demo page and view source.  You will see the js which injects the hook, you can inject this into the url, then send this to people through email.

[Cyber "Max" Shaman]

either you exploit or report