[anonymous_bdc]

Deleted their products for sale, and added this on the only page that I could really edit.

Code

http://www.signwaves.co.uk/content/Print

🤝

[Natalie Portman]

GG.

Next time try using XSS to deface it, like using the following codes as the name for the product, or the description.

Code

<script>window.location = "http://www.yourdefacepage.com"</script>

Or, if script tags are blocked:

Code

<meta http-equiv="refresh" content="0; url=http://www.yourdefacepage.com">

[anonymous_bdc]

GG.

Next time try using XSS to deface it, like using the following codes as the name for the product, or the description.

Code

<script>window.location = "http://www.yourdefacepage.com"</script>

Or, if script tags are blocked:

Code

<meta http-equiv="refresh" content="0; url=http://www.yourdefacepage.com">

I tried using the <meta http-equiv="refresh" content="0; url=http://www.yourdefacepage.com"> code for a redirection deface, it didnt work. The site has a weird HTML editing program like PHPnuke used to have, it doesnt save stuff properly.

Ill try the <script>window.location = "http://www.yourdefacepage.com"</script> one now, theres a page called home / products. See if that works.

[Phizo]

GG.

Next time try using XSS to deface it, like using the following codes as the name for the product, or the description.

Code

<script>window.location = "http://www.yourdefacepage.com"</script>

Or, if script tags are blocked:

Code

<meta http-equiv="refresh" content="0; url=http://www.yourdefacepage.com">

It's not really XSS if you're able to edit the files.

[Natalie Portman]

It's not really XSS if you're able to edit the files.

Well, it is, considering that XSS stands for Cross-Site-Scripting.

You are scripting between sites; therefore, XSS?

It's just persistent.

Correct me if I'm wrong,
- Envyy

[orunu]

Well, it is, considering that XSS stands for Cross-Site-Scripting.

You are scripting between sites; therefore, XSS?

It's just persistent.

Correct me if I'm wrong,
- Envyy

i would say if your editing the page directly its just normal JS and all that if your doing it via comment/status box ect.. then its xss

[Phizo]

Well, it is, considering that XSS stands for Cross-Site-Scripting.

You are scripting between sites; therefore, XSS?

It's just persistent.

Correct me if I'm wrong,
- Envyy

Here is how I see it.
It's not a cross site scripting vulnerability because there is no vulnerability to begin with. Anyone can write a page that contains Javascript (or otherwise) inside it and upload it, that just makes it a page, it's not a vulnerability at all.
Also, you aren't "scripting between sites", that doesn't make any sense.

In respone to this:

Next time try using XSS to deface it, like using the following codes as the name for the product, or the description.

The correct terminology would be "Next time try using Javascript or HTML to redirect the current page to another page."
You aren't defacing, you're redirecting to another page.

Definition of deface:
Spoil the surface or appearance of (something), e.g., by drawing or writing on it.

You're not really spoiling the surface of it, you're just redirecting them.

Hope this helps.

[Project13]

scripting between sites bahahahaha, and Phizo is right, you can't deface with XSS, you can only redirect, unless you use XSS to get to the admin panel