Damn, it is a dot.net site I guess..it doesnt allow <s ... hmm..very tricky..how did you solve it, I must know
What can you do with with it? Tesco is a one of the largest supermarket in the UK.
Did you find it in the search function?
yeah, did you bypass the :
dangerous request.form error
There isnt an error, but if there was no custom field.
By the url, I can see that you are in the homepage.. can u XSS the search box...or is it not possible?
On what browser did you do the injection?
ah this is irking the sh!t out of me lol, I am close I think.. Im still learning this. Will post results soon as i figure it out
(Jul 6, 2013 11:45 AM)Gee4rce Wrote: Done.
Yes i would rate this one as a medium -
finally, a Challenge wich really included some challenging part (after tons of standard <script>alert(0)</script> search box 'challenges' which have been postet in the past)...
[img]http://img442.imageshack.us/img442/1563/frgm.png[/img]
Thanks for the challenge!
PS.:
Ohh, there was also some sort of Redirect problem, here;
(Copy & Paste for demonstration)
Code http://www.tesco.com/r/?from=HomePageHelp&url=//pwnyc0d3.t.gp/b00bs/
Greets, Gee 😅 n00b i dont click on site , you are n00b it a lfi?
(Jul 6, 2013 11:45 AM)Gee4rce Wrote: PS.:
Ohh, there was also some sort of Redirect problem, here;
(Copy & Paste for demonstration)
Code http://www.tesco.com/r/?from=HomePageHelp&url=//pwnyc0d3.t.gp/b00bs/
Greets, Gee 😅
I will never ever again click on any your link. I think i am dead.
(Jul 6, 2013 01:01 PM)Milf Wrote: XSS is the most meaningless exploit you can ever find.
That wasn't funny, kid.
Low Quality Post. http://www.securitytube.net/video/7915
not really meaningless
God dang Gee4rce..
I just registered here and already had the shit scared out of me.. lol.
OP: I would have absolutely no idea how to even begin hacking anything lol... but goodluck to everyone in the challenge... maybe one day I will be able to give it a go :)
I havent got the time to sit on that site a lot of time.. could someone pm me the solution
(Jul 6, 2013 09:16 PM)Gee4rce Wrote: Yes you will, just dont give up...
For the start you should check out 'google hacking', its also helps for basic understanding how the web worx
make shure that you understand HTML and a bit of JavaScript... With that then, you can start with XSS, as it varys from very easy to extrem hard..
Then comes PHP & SQLi, the next step,- theese are the most common techniques used for webh4x,
besides LFI/RFI and command execution...
This is one of HF's best Tutorial collections on Webh4x:
https://hackforums.net/showthread.php?tid=2008347
Greets, Gee. Thank you for the support and for pointing me in the right direction mate, I'll be sure to stick to it... I'm sure when I learn a few things and get the rewarding feeling of accomplishment when something goes right it'll motivate me to hang around and learn more. :)
|
