[krianga]

I started hacking when I was 12 but still kinda struggling

[Wᴀᴄᴋᴏ]

I started hacking when I was 12 but still kinda struggling

Oh my god. This is from 4 years ago! Read the dates before gravedigging useless threads.

[Kristofferson]

I can teach you my ways of defacing websites and such, email me @ [email protected] <3

My dork was (inurl:"index.php?page=home.html") and (inurl:"index.php?page=about.html"), mainly basic names of pages you would find on the net.

Dat LFI Dork. 🤝
We all agree that XSS is fucking useless unless on a site like paypal (Adding a little script to the cache of the login that's a JS keylogger).

[Th3PonyWizard]

Dat LFI Dork. 🤝
We all agree that XSS is fucking useless unless on a site like paypal (Adding a little script to the cache of the login that's a JS keylogger).

Figuring out the true power of XSS is what separates newbies from experts :)

[Wᴀᴄᴋᴏ]

Figuring out the true power of XSS is what separates newbies from experts :)

Yes but this is XSS loaded in an iFrame. I'm not positive, but doesn't it mean the JavaScript can't get cookies and shit from that site because it's technically in a different location?

[cheatson]

Yes but this is XSS loaded in an iFrame. I'm not positive, but doesn't it mean the JavaScript can't get cookies and shit from that site because it's technically in a different location?

The same-origin rule applies so for a different domain/protocol/port it wouldnt work. However, I found a workaround for that last year, I'm sure there are others. You can specify the src as data/html and inject javascript directly to the page. It's then therefore same origin and bypasses this rule. http://www.hackers2devnull.blogspot.co.u...ility.html Alternatively, you could break out of the iframe in the example given by the op because the output is not even sanitized.

[Orianthi]

I never understood HTML. Maybe one of you guys could link me to a good XSS tutorial you enjoyed?