[Phizo]

I don't mean to insult you but I cant express it in any other form; instead of complaining about this can you please do some tuts about the advance XSS ? if your thread gets attention it will sure improve a lot of members skills

I'm guessing you seen my thread on basic XSS then since you're requesting me to make an advanced one.
Since I was gone there have been advanced tutorials posted, why not check them out?

[DaNet]

XSS is an indicator about the website security. Releasing these is useless.
But i'm for the release of XSS when it's a big website.

[Eshta]

I'm guessing you seen my thread on basic XSS then since you're requesting me to make an advanced one.
Since I was gone there have been advanced tutorials posted, why not check them out?

All the tutorials I have read here are about cookie stealing it from the admin, is that what you mean by "advance" ?

[Phizo]

XSS is an indicator about the website security. Releasing these is useless.
But i'm for the release of XSS when it's a big website.

You're mistaken. XSS is not an indicator, it's a vulnerability.
Majority of this section use it as an indicator, that's the whole point of this thread.

---

All the tutorials I have read here are about cookie stealing it from the admin, is that what you mean by "advance" ?

By advanced I was thinking of WAF bypassing.
Anyway, XSS tutorials aren't going to help you get better. Learn HTML and Javascript if you want to get better.

[DaNet]

Yes, it's a vulnerability. Thus, instead of posting the XSS, posting the XSS exploited, with a result. Not just a message box. That's will better.

[Hycca]

I once suggested that only top 10 alexa sites , worldwide or per country should be allowed for [xss] post.

Top 10? Then there will be no XSS at all in this section.
Also, I'd rather see XSS than those random defaces which make me mad >.<

[MaXoNe]

Web Application Obfuscation book. It has chapters on bypassing XSS filters.

[Phizo]

Top 10? Then there will be no XSS at all in this section.
Also, I'd rather see XSS than those random defaces which make me mad >.<

My thoughts exactly haha.

fuku35chars

[Dyme]

I actually nudged at the same topic on a thread I posted a while back. What happend? I got flammed. I'm glad that your making more progress.

https://hackforums.net/showthread.php?tid=2159440

[Sasori]

I can understand what you're saying and I do agree.
Another thing that pisses me off is things like this:

https://hackforums.net/showthread.php?tid=2395496

[Prominent]

Couldn't have said it better myself, I dislike the amount of lame XSS threads I see daily.. I hope this thread gets some attention.

[Phizo]

I can understand what you're saying and I do agree.
Another thing that pisses me off is things like this:

https://hackforums.net/showthread.php?tid=2395496

Oh god, Havij is what I hate the most out of anything else that I can think of.

---

Couldn't have said it better myself, I dislike the amount of lame XSS threads I see daily.. I hope this thread gets some attention.

Yeah, me too.
A lot of users have been telling me to try make a difference and "show them what real hacking is" -- quoted from a few users.
I'm just trying to make a few changes to improve quality in threads, as well as their actual skills in XSS.

[Curator]

There's little point in posting a reflective XSS on any site unless it's a really major one, like Google, Youtube, Paypal, Facebook, etc.

However, a persistent XSS on just about any site can be very powerful, so I don't think there's a problem in posting those and using an alert as an example if you find one.

[Phizo]

There's little point in posting a reflective XSS on any site unless it's a really major one, like Google, Youtube, Paypal, Facebook, etc.

However, a persistent XSS on just about any site can be very powerful, so I don't think there's a problem in posting those and using an alert as an example if you find one.

There is a problem.

• That's all they know how to do, they don't know anything other then how to alert.
  


• Persistent XSS on a random site? Self-explanatory.
  


• Nipples.
  

[JoinSeventh]

Here is my thoughts on the subject:

XSS is a powerfull vulnerability if you know your shit, but most of these guys doesn't.
It would be like if I run a Nessus scan on a random website and posted shit like "OMG LOOK THE SSL IS OLD AND INSECURE".
Pointless? Yes. Illogical? Yes. The same this that is happening? Yes.

I'm not saying that posting making posts about your XSS finds is bad, but:
Why not try to actually exploit them before publish?
I mean if I would find a SQL Injection vulnerability in some company website, I would actually tro the exploit it first.
Not because I necessarily want to dump the DB or own the box, but to show Proof of Concept.

Just my thoughts, hate all you want.