ProxiesFood: Unlimited Residential Proxy ◆ Spoof Call and Spoof SMS set any caller ◆ Cheap KYC Verifications & Openups ◆ Anvilpoint CyberOps - Hacker for Hire ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking › XSS CNN vector, need explanation please

New Reply 

XSS CNN vector, need explanation please
unnamednoob
Guest
 
Sep 8, 2012 06:35 PM
edition.cnn.com/search/index.html?sortBy=date&primaryType=mixed&source=money&query="><iframe+onload%3Dalert%28%2FXSS%2F%29>

i don't understand how this work, im not the best at XSS, if someone mind explaining that for me? :)
KernelMode
KernelMode Offline
Starlite
***
HF Ub3r
Posts:
1,301
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Sep 8, 2012 06:39 PM (This post was last modified: Sep 8, 2012 06:40 PM by KernelMode.)
I'm pretty sure this is how it would work... :L

"> was used to escape the value="search here".
<iframe creates an iframe.
onload= onload is when the page loads.
alert(/XSS/)> displays the message box and closes the tag.
[Image: eh4TL.gif]
Desmolicious
Guest
 
Sep 8, 2012 06:47 PM
That XSS was patched awhile ago. XD Same with money.cnn.com
unnamednoob
Guest
 
Sep 8, 2012 07:06 PM
(Sep 8, 2012 06:39 PM)KernelMode Wrote:  I'm pretty sure this is how it would work... :L

"> was used to escape the value="search here".
<iframe creates an iframe.
onload= onload is when the page loads.
alert(/XSS/)> displays the message box and closes the tag.

yea, i though so too, but what confussed me is when i only typed "><script>alert(0)</script> it didn't work

(Sep 8, 2012 06:47 PM)Desmolicious Wrote:  That XSS was patched awhile ago. XD Same with money.cnn.com

still works for me O_o, are u sure?
Jae‌
Guest
 
Sep 8, 2012 07:16 PM
(Sep 8, 2012 06:47 PM)Desmolicious Wrote:  That XSS was patched awhile ago. XD Same with money.cnn.com

It's obviously not patched if it's still functioning. 😅
Desmolicious
Guest
 
Sep 8, 2012 07:22 PM
(Sep 8, 2012 07:16 PM)Jae‌ Wrote:  It's obviously not patched if it's still functioning. 😅
D: It doesn't Function for any of my webBrowsers.. @Failure?
Jae‌
Guest
 
Sep 8, 2012 07:25 PM
(Sep 8, 2012 07:22 PM)Desmolicious Wrote:  D: It doesn't Function for any of my webBrowsers.. @Failure?

Strange. Check the URL hasn't messed up, it's working fine for me.
Desmolicious
Guest
 
Sep 8, 2012 07:27 PM
(Sep 8, 2012 07:25 PM)Jae‌ Wrote:  Strange. Check the URL hasn't messed up, it's working fine for me.
Alright, Maybe there's an error in the Script i'm using.
ownster
ownster Offline
[user@HF:]
*
Registered
Posts:
173
Threads:
4
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Sep 8, 2012 07:35 PM
This is cooler :L
http://edition.cnn.com/search/index.html...marquee%3E
:D, Anyways they should fix this lmao.
JrMn
Guest
 
Sep 9, 2012 01:22 AM
(Sep 8, 2012 07:22 PM)Desmolicious Wrote:  D: It doesn't Function for any of my webBrowsers.. @Failure?

Chrome has a XSS filter against reflected (or non-persistant) XSS.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by Gee4rceApr 19, 2021 06:47 AM 26 4,062 Apr 19, 2021 06:47 AM
Last Post: theghostofgreen
by longwenzhangDec 12, 2019 07:54 AM 0 229 Dec 12, 2019 07:54 AM
Last Post: longwenzhang
by frank3nstienJul 18, 2019 10:38 PM 2 325 Jul 18, 2019 10:38 PM
Last Post: frank3nstien