[skillrooted]

I found a xss vulnerable site which is persistent i guess..:
http://www.madgam.es/search?key=%3Cscrip...cript%3E&s=

I want to deface it from here, i've not defaced earlier but I have read a no. of articles on it, but I'm unable to apply here.
Please help

[๖ۣۣۜۜFear]

Let's get a few things straight.

1. That is not persistent, that is the opposite of persistent. Persistent is that every time you load that page (without doctoring the link) it loads.
2. XSS can't be used to deface, all you can do is play with client side.

Best bet? Report it and see if you get recognition.

[CyberSyringe]

I found a xss vulnerable site which is persistent i guess..:
http://www.madgam.es/search?key=%3Cscrip...cript%3E&s=

I want to deface it from here, i've not defaced earlier but I have read a no. of articles on it, but I'm unable to apply here.
Please help

Nope, not persistent, but rather non-persistant.

It's only persistent if you don't have to inject the code every time into the vector.

The only way to deface is to hijack the admin's cookie session when he is logged in. To do that you must trick the website administrator into opening the XSS link and run a cookie stealer script.

[skillrooted]

Let's get a few things straight.

1. That is not persistent, that is the opposite of persistent. Persistent is that every time you load that page (without doctoring the link) it loads.
2. XSS can't be used to deface, all you can do is play with client side.

Best bet? Report it and see if you get recognition.

Thanks for correcting me..I've reported xss earlier in some sites, hardly they reply to mails :/

---

Nope, not persistent, but rather non-persistant.

It's only persistent if you don't have to inject the code every time into the vector.

The only way to deface is to hijack the admin's cookie session when he is logged in. To do that you must trick the website administrator into opening the XSS link and run a cookie stealer script.

hmm..okay got it..i've read about cookie stealing.
Thanks a lot for help :)

[sp3ctrum]

Just to make a few corrections in this thread, yes the XSS is not persistent but you can deface with XSS if its persistent. Just by using <script>window.location="http://linktoyourdeface.com/deface.html";</script> or you could use more javascript such as document.write or document.getElementById. Its pretty simple and can be done :3

[skillrooted]

Just to make a few corrections in this thread, yes the XSS is not persistent but you can deface with XSS if its persistent. Just by using <script>window.location="http://linktoyourdeface.com/deface.html";</script> or you could use more javascript such as document.write or document.getElementById. Its pretty simple and can be done :3

Can you please give me a persistent xss vulnerable site ?
I want to try defacing thing..

[H4x0r r0cky]

Skill rooted why not keep searching,you might come across a site that is vulnerable to persistent xss..But its rare.

[CyberSyringe]

Just to make a few corrections in this thread, yes the XSS is not persistent but you can deface with XSS if its persistent. Just by using <script>window.location="http://linktoyourdeface.com/deface.html";</script> or you could use more javascript such as document.write or document.getElementById. Its pretty simple and can be done :3

You forgot that in order to deface the main page, there must be a persistant that can be executed from the main page.

[vehla]

You forgot that in order to deface the main page, there must be a persistant that can be executed from the main page.

He didn't meant to deface the main page though as I read. 🤝

[sp3ctrum]

Yes I'm aware of that. The possibility of finding a persistent XSS is very little and especially on the home page to begin with. I was implying defacing in general, although much more can be done with it besides defacing, xss shell, beef exploitation, taking advantages of redirect links to your shitcash or whatever, etc..

[skillrooted]

Skill rooted why not keep searching,you might come across a site that is vulnerable to persistent xss..But its rare.

Yes, I'm searching to search for a persistent one:)

[jp000006]

try looking for websites that accepts comments, like forums or whatsoever..u can 'persistent xss' that

[skillrooted]

try looking for websites that accepts comments, like forums or whatsoever..u can 'persistent xss' that

okay..thanks for the advice, i will look out for it :)

[vehla]

Nowadays, I find most of sites vulnerable to Persistent xss. Just use your brain and you can find 1 for sure in every site.

[LevelUp]

This is a non persistant XSS.

You can't do much with this site because it uses a Facebook Login rather than its own, and I can't seem to find the admin panel.

If circumstances were different:
Set up a PHP Cookie Stealer which stores the data in a .txt then hex/shorten this URl and send it to the admin.

Code

http://www.madgam.es/search?key=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&s=