[Phizo]

I don't know if it's just me that has noticed this, but this section is being flooded with the following:

[XSS] longdomainnoonehasheardof.com [/XSS]

Okay, I can understand if it was Google, Youtube, Facebook or something that's well known.
Most of the people in this section think that it's amazing to make a little alert box saying "XSS By NuLL_Byt3_R00T_HAK3R", is that seriously what the majority of this section is going to post?

Come on guys, it's a bit lame. How about actually trying to gain access instead of displaying alert boxes. There's nothing amazing and unique about it.

Quoted from JoinSeventh:

Here is my thoughts on the subject:

XSS is a powerfull vulnerability if you know your shit, but most of these guys doesn't.
It would be like if I run a Nessus scan on a random website and posted shit like "OMG LOOK THE SSL IS OLD AND INSECURE".
Pointless? Yes. Illogical? Yes. The same this that is happening? Yes.

I'm not saying that posting making posts about your XSS finds is bad, but:
Why not try to actually exploit them before publish?
I mean if I would find a SQL Injection vulnerability in some company website, I would actually tro the exploit it first.
Not because I necessarily want to dump the DB or own the box, but to show Proof of Concept.

Just my thoughts, hate all you want.

[Hycca]

Well, it at least keeps the section going. Although some XSS vulns posted here are at sites nobody ever heard of and I admit, that's kind of annoying.

[Phizo]

Well, it at least keeps the section going. Although some XSS vulns posted here are at sites nobody ever heard of and I admit, that's kind of annoying.

Yeah, it keeps the section going which is good.
However, what about other vulnerabilities, what about ones that actually matter.
I'm not saying XSS doesn't matter, but the people on this forum obviously don't know how to unlock it's full potential and flail around with alert boxes.

Sorry, but there's nothing cool about it.

[Susp3cT]

Yeah I see where ur going. Well people start thinking of XSS attack vectors, is the most dangerous thing.
Also I miss the old days, where the website section was mostly into the rooting! - since rooting is A FUN SPORT!!
I did a few posts as well, but yeah, to straight it out, I'm stuck at this box, since I need to figure out an exploit.

Shelled website, about to r00t the server.
I tried to enumerate all my enforcements at 1337day, Exploit-DB, securityfocus.
Did not yet tried the command

Code

cd /pentest/exploits/exploitdb
cat files.csv | egrep -i "linux|kernel|local" | web | grep 05

The box which I shelled upon

Code

Linux web05-07 3.0.9-vs2.3.1-20111121-96c063c #1 SMP Mon Nov 21 09:54:21 UTC 2011 x86_64

Anyways, do you got some advice.. I tried on my own thread,
but no one had answer! 🤝 not even my self.

Out & Over

[Phizo]

Yeah I see where ur going. Well people start thinking of XSS attack vectors, is the most dangerous...
I did a few posts as well, but yeah, to straight it out, I'm stuck at this box, since I need to figure out an exploit.

Shelled website, about to r00t the server.
I tried to enumerate all my enforcements at 1337day, Exploit-DB, securityfocus.
Did not yet tried the command

Code

cd /pentest/exploits/exploitdb
cat files.csv | egrep -i "linux|kernel|local" | web | grep 05

Code

Linux web05-07 3.0.9-vs2.3.1-20111121-96c063c #1 SMP Mon Nov 21 09:54:21 UTC 2011 x86_64

Anyways, do you got some advice.. I tried on my own thread,
but no one had answer! :evil: not even my self.

Out & Over

XSS attack vectors? Yeah, for more alert boxes xD.
Anyway, to your question.

I have never seen that kernel version before, and it was released in 2011 as it says. I just tried searching up that kernel version on Google and there wasn't much to go on.
Sorry, but I've never seen that kernel version, maybe try rooting it manually instead of relying on local root exploits to perform the task for you, that's all I can suggest.

Good luck.

[Susp3cT]

XSS attack vectors? Yeah, for more alert boxes xD.
Anyway, to your question.

I have never seen that kernel version before, and it was released in 2011 as it says. I just tried searching up that kernel version on Google and there wasn't much to go on.
Sorry, but I've never seen that kernel version, maybe try rooting it manually instead of relying on local root exploits to perform the task for you, that's all I can suggest.

Good luck.

Yeah the forum did explode with a lot of ways of doing XSS statements.
In this way, we can conclude that this section does preform in mostly XSS attacks. As told, miss the old times!

Now to your answer...

Well, yeah that what I tried as well on Google. But with no luck!. I guess I have to study this kernel for a bit. Never back down! - The greater you dig, the greater chance for success. That is what I have learnt from the past... Anyways, thx for your answer 🤝

[fobber]

I don't mind people posting all these XSS'es. As long as it isn't a non-persistent XSS on some stupid 11 year old girl's blog, about her stupid bird.

A sub-forum would be a great idea. Then you guys wouldn't have to bother looking at our awesome XSS finds. And we don't have to look at all your posts about "XSS ==== useless. Stop spamm da forumzz". No offence; but I've seen quite a few of those posts lately.

I'm sure that you, Phizo, is a super pro 1337 hacker (No sarcasm, really. I think you are. You've even helped me.), and you should therefore also understand the "power" of XSS.

When we do make an alert box, we just show that we could do some sick haxor stuff to the website, but we're way too nice to do that.

Again. No offence. Damn, I'd really love a XSS sub forum.

[Phizo]

I don't mind people posting all these XSS'es. As long as it isn't a non-persistent XSS on some stupid 11 year old girl's blog, about her stupid bird.

A sub-forum would be a great idea. Then you guys wouldn't have to bother looking at our awesome XSS finds. And we don't have to look at all your posts about "XSS ==== useless. Stop spamm da forumzz". No offence; but I've seen quite a few of those posts lately.

I'm sure that you, Phizo, is a super pro 1337 hacker (No sarcasm, really. I think you are. You've even helped me.), and you should therefore also understand the "power" of XSS.

When we do make an alert box, we just show that we could do some sick haxor stuff to the website, but we're way too nice to do that.

Again. No offence. Damn, I'd really love a XSS sub forum.

As long as it isn't a non-persistent XSS on some stupid 11 year old girl's blog, about her stupid bird. <--- Seriously loved that.

No offence taken. This is my 2nd day of being back on HF from a year of inactivity, so I haven't seen any of these threads.
I know XSS is 'powerful', however majority of the users do not understand or know it's full potential, they aren't just showing alert boxes because they don't want to damage the site. The truth is they don't know how to.
That's the truth, the truth is inevitable.

[Susp3cT]

As long as it isn't a non-persistent XSS on some stupid 11 year old girl's blog, about her stupid bird. <--- Seriously loved that.

No offence taken. This is my 2nd day of being back on HF from a year of inactivity, so I haven't seen any of these threads.
I know XSS is 'powerful', however majority of the users do not understand or know it's full potential, they aren't just showing alert boxes because they don't want to damage the site. The truth is they don't know how to.
That's the truth, the truth is inevitable.

It's quite easy to lead it into a full OS compromise, if you know how to preform 👹 ... Like a baws!

Tutorial by a member of Team Intra, has posted this 👍

[Phizo]

It's quite easy to lead it into a full OS compromise, if you know how to preform 👹 ... Like a baws!

Tutorial by a member of Team Intra, has posted this 👍

That's correct, it can indeed lead to a full OS compromise, I have read on it.
Also things like Javascript buffer overflows can be done using XSS, some scary stuff out there.
However, people like to stick with good ol' alert("HAXERRR");

[Susp3cT]

That's correct, it can indeed lead to a full OS compromise, I have read on it.
Also things like Javascript buffer overflows can be done using XSS, some scary stuff out there.
However, people like to stick with good ol' alert("HAXERRR");

Yeah quite sad, that people do not post such as [XSS OS compromise] 😈
It would be A LOT more interesting to hear about, like SE your friend to a phishing site, with malicious intent.
Compromise the host, afterwards migrating the session and then, the fun part starts...
And it's also FUN! Anyways, yeah damn it's scary, cause if you got the knowledge, like a baws haha - well then you can do A LOT of damage...

[fobber]

That's correct, it can indeed lead to a full OS compromise, I have read on it.
Also things like Javascript buffer overflows can be done using XSS, some scary stuff out there.
However, people like to stick with good ol' alert("HAXERRR");

Yeah. It's probably true, that quite some on here, don't know what they could actually do with XSS/javascript.

You even do a window.location to some really sick gay website (sorry if you happen to be gay), and then tell your friends to go on that website. Lol. That's a classic.

[Phizo]

Yeah. It's probably true, that quite some on here, don't know what they could actually do with XSS/javascript.

You even do a window.location to some really sick gay website (sorry if you happen to be gay), and then tell your friends to go on that website. Lol. That's a classic.

Fuck you, I'll kill you. I'm gay you know.

Haha, just kidding. Yeah, that's funny to do, but it wouldn't be very appropriate to do it on HF, it's still nothing to be like ZOMG HAAXX!11!! about.

[MaXoNe]

I once suggested that only top 10 alexa sites , worldwide or per country should be allowed for [xss] post.

[Eshta]

I don't mean to insult you but I cant express it in any other form; instead of complaining about this can you please do some tuts about the advance XSS ? if your thread gets attention it will sure improve a lot of members skills