[Cathal]

I usually hate these kind of threads, but this one took me fucking ages, even though the end vector was unbelievably simple.

Here's the site: http://www.tesco.com/

[img]http://aspectmodding.net/cap/15d1b0853d0a0a7a77cd.png[/img]

And here's the proof:
Spoiler (Click to View)[img]http://aspectmodding.net/cap/ab5385e608443dd851de.png[/img]

Oh, pm me dem vectors.

Solvers
xXSehgalXx
cheatson
Gee4rce
PuzzuS

EDIT - ._. Easy challenge is easy.

[Anarchist001]

Damn, it is a dot.net site I guess..it doesnt allow <s ... hmm..very tricky..how did you solve it, I must know

[xXSehgalXx]

Easy - Test your basic knowledge

Spoiler (Click to View)

[cheatson]

This wasn't trivial for me at all although may have reinvented the wheel for it in the end. Good challenge!

[Possession]

What can you do with with it? Tesco is a one of the largest supermarket in the UK.

[Anarchist001]

Did you find it in the search function?

[Cathal]

Did you find it in the search function?

I'm sorry, didn't you say you were a pentester?

[Anarchist001]

yeah, did you bypass the :
dangerous request.form error
There isnt an error, but if there was no custom field.

By the url, I can see that you are in the homepage.. can u XSS the search box...or is it not possible?

[Cathal]

yeah, did you bypass the :
dangerous request.form error
There isnt an error, but if there was no custom field.

By the url, I can see that you are in the homepage.. can u XSS the search box...or is it not possible?

This is a challenge, mister pentester.

[Anarchist001]

On what browser did you do the injection?

[0rph4n]

ah this is irking the sh!t out of me lol, I am close I think.. Im still learning this. Will post results soon as i figure it out

[Gee4rce]

Done.
Yes i would rate this one as a medium -
finally, a Challenge wich really included some challenging part (after tons of standard <script>alert(0)</script> search box 'challenges' which have been postet in the past)...

[img]http://img442.imageshack.us/img442/1563/frgm.png[/img]

Thanks for the challenge!

PS.:
Ohh, there was also some sort of Redirect problem, here;

(Copy & Paste for demonstration)

Code

http://www.tesco.com/r/?from=HomePageHelp&url=//pwnyc0d3.t.gp/b00bs/

Greets, Gee 😅

[domex27]

Done.
Yes i would rate this one as a medium -
finally, a Challenge wich really included some challenging part (after tons of standard <script>alert(0)</script> search box 'challenges' which have been postet in the past)...

[img]http://img442.imageshack.us/img442/1563/frgm.png[/img]

Thanks for the challenge!

PS.:
Ohh, there was also some sort of Redirect problem, here;

(Copy & Paste for demonstration)

Code

http://www.tesco.com/r/?from=HomePageHelp&url=//pwnyc0d3.t.gp/b00bs/

Greets, Gee 😅

n00b i dont click on site , you are n00b it a lfi?

[Gee4rce]

n00b i dont click on site , you are n00b it a lfi?

lawl, you call le me a n00b :D ?!
Well if thats an LFI then go and report it - you will get amazingly tons of Ca$$$$h !!!! 🤣

"you are n00b it a lfi?"
(erm... English?)

[MFFS]

PS.:
Ohh, there was also some sort of Redirect problem, here;

(Copy & Paste for demonstration)

Code

http://www.tesco.com/r/?from=HomePageHelp&url=//pwnyc0d3.t.gp/b00bs/

Greets, Gee 😅

I will never ever again click on any your link. I think i am dead.