[Newbyte]

Hi everyone

I've found a website where i can inject Javascript but only certain html tags. Tags like script aren't accepted. However, the website does accept img tags so I can display images and call php scripts. All of this is fun and all but I was wondering if there is something more exciting that you can do with it like exploiting the website or getting the cookies of the page.


If anyone knows something, you can post it.

[linkinpork]

I was wondering if there is something more exciting that you can do with it like exploiting the website or getting the cookies of the page.


If anyone knows something, you can post it.

Iframes, as in

< iframe src="https://linkinporkhf.github.io" >

Second answer in this StackOverflow thread shows how you can make a full-page version of it, essentially allowing you to totally deface the webpage https://stackoverflow.com/questions/1771...age-iframe

[skull]

In order to get the cookies, you must trigger some JavaScript.
But you can use the image src to send data your way once you found a way to gather it.

[Newbyte]

The  redirect from one of those examples can be used for an activity that is disallowed to be discussed here.

What do you mean?

[linkinpork]

What do you mean?

Disallowed BlackHat Activity

Listen to [mention=4963606] , he spends enough time in the Blackhat section to know this better than most.