[unnamednoob]

edition.cnn.com/search/index.html?sortBy=date&primaryType=mixed&source=money&query="><iframe+onload%3Dalert%28%2FXSS%2F%29>

i don't understand how this work, im not the best at XSS, if someone mind explaining that for me? :)

[Desmolicious]

That XSS was patched awhile ago. XD Same with money.cnn.com

[unnamednoob]

I'm pretty sure this is how it would work... :L

"> was used to escape the value="search here".
<iframe creates an iframe.
onload= onload is when the page loads.
alert(/XSS/)> displays the message box and closes the tag.

yea, i though so too, but what confussed me is when i only typed "><script>alert(0)</script> it didn't work

---

That XSS was patched awhile ago. XD Same with money.cnn.com

still works for me O_o, are u sure?

[Jae‌]

That XSS was patched awhile ago. XD Same with money.cnn.com

It's obviously not patched if it's still functioning. 😅

[Desmolicious]

It's obviously not patched if it's still functioning. 😅

D: It doesn't Function for any of my webBrowsers.. @Failure?

[Jae‌]

D: It doesn't Function for any of my webBrowsers.. @Failure?

Strange. Check the URL hasn't messed up, it's working fine for me.

[Desmolicious]

Strange. Check the URL hasn't messed up, it's working fine for me.

Alright, Maybe there's an error in the Script i'm using.

[JrMn]

D: It doesn't Function for any of my webBrowsers.. @Failure?

Chrome has a XSS filter against reflected (or non-persistant) XSS.