good read

I don't know if anybody has read this but I thought it was some good info on XSS:

https://www.elitehackers.info/forums/showthread.php?p=52491

BBBBBoring……………Basic old bullshit.

That wasn't really a good read at all. It showed painfully simple XSS, and I don't even recall it explaining how to use XSS to do any real exploiting, not even password stealing…. Hip hip hooray for the painfully useless applications of XSS :|

I was talking about it covered the concept very well. And using it in a different way than just getting cookies.

austinator wrote: I was talking about it covered the concept very well. And using it in a different way than just getting cookies.

http://keepitlocked.net/archive/2008/06/17/quot-the-spy-who-hacked-me-quot-teched-2008-demo.aspx

I know I've posted this here before, but it looks like you might find it interesting. It shows real, mostly uncovered attack vectors of XSS. Doesn't cover the coding behind it, it simply shows the attack being performed. A lot better than redirecting to a download. Woopdeedoo :|

Oh yea I've seen this before Veeeeeeeeeeeeeeeery interesting thanks for the link again. :)

I haven't found too many site so far that can have this done to..

I want my seven seconds back.

Dangers of XSS…

these day's browser keep some of the dangers of XSS outside.. Like.. if an script want to write/edit edit files on the computer it needs extra permission from the user… or by some browsers it just get blocked…

I mean, seriously?

Don't forget the time it took to selectively quote and post…

I didn't even notice all of the typos on that page until after reading Spyware's quote.. Well, I hope they are typos, because if they aren't, whoever wrote that article must be very…. . uneducated…

Night_Stalker wrote: I didn't even notice all of the typos on that page until after reading Spyware's quote.. Well, I hope they are typos, because if they aren't, whoever wrote that article must be very…. . uneducated…

Typo's? Are you fucking kidding me?

I could care less about the typo's, the informational value is BELOW OIL RESERVES.

It's sad.

Well, I was expecting things to be more advanced.. Much more advanced…. :(

spyware wrote: [quote]Night_Stalker wrote: I didn't even notice all of the typos on that page until after reading Spyware's quote.. Well, I hope they are typos, because if they aren't, whoever wrote that article must be very…. . uneducated…

Typo's? Are you fucking kidding me?

I could care less about the typo's, the informational value is BELOW OIL RESERVES.

It's sad.[/quote]

Eh, it came from elitehackers.info what do you expect?? :xx:

true, it was pretty basic and actually is pretty obfuscating imo.

Night_Stalker wrote: I haven't found too many site so far that can have this done to..

Really? XSS is the most commonly found web vulnerability on the internet. I have found xss in quite a few sites…

Just look at the HoF for how many have been found here.

Remember there are more than just persistent xss ;)