question 1 ?

i got this error when i was trying an xss on a site and i don't know what it is somaybe you can figure it out

Server Error in '/' Application.

A potentially dangerous Request.Form value was detected from the client (ctl00$ctl00$ctl07$txtSearch=""/><marqee><h1>fallingm…"). Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.

Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (ctl00$ctl00$ctl07$txtSearch=""/><marqee><h1>fallingm…").

Source Error:

The source code that generated this unhandled exception can only be shown when compiled in debug mode. To enable this, please follow one of the below steps, then request the URL:

1. Add a "Debug=true" directive at the top of the file that generated the error. Example:

<%@ Page Language="C#" Debug="true" %>

or:

2. Add the following section to the configuration file of your application:

<configuration> <system.web> <compilation debug="true"/> </system.web> </configuration>

Note that this second technique will cause all files within a given application to be compiled in debug mode. The first technique will cause only that particular file to be compiled in debug mode.

Important: Running applications in debug mode does incur a memory/performance overhead. You should make sure that an application has debugging disabled before deploying into production scenario.

Stack Trace:

[HttpRequestValidationException (0x80004005): A potentially dangerous Request.Form value was detected from the client (ctl00$ctl00$ctl07$txtSearch=""/><marqee><h1>fallingm…").] System.Web.HttpRequest.ValidateString(String s, String valueName, String collectionName) +3308446 System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, String collectionName) +108 System.Web.HttpRequest.get_Form() +119 System.Web.HttpRequest.get_HasForm() +57 System.Web.UI.Page.GetCollectionBasedOnMethod(Boolean dontReturnNull) +2070529 System.Web.UI.Page.DeterminePostBackMode() +63 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +6978 System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +213 System.Web.UI.Page.ProcessRequest() +86 System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context) +18 System.Web.UI.Page.ProcessRequest(HttpContext context) +49 ASP.index_aspx.ProcessRequest(HttpContext context) +4 System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +303 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +64

Version Information: Microsoft .NET Framework Version:2.0.50727.832; ASP.NET Version:2.0.50727.832

Did you get an alert to pop up?

i was using "/><marqee><h1>fallingmidget</h1></marquee>

but yeah it worked. i was just wondering because this is like the 5th site today that was using .aspx that has done this.

.aspx pages are usualy quite sophsitacted web apps so if your getting tht type of error it probs means tht you've got more than just xss vunrabilitis

hence me asking. but so far i'm at 24 web site that have given me that all using

search.aspx?s="/><marquee><h1>fallingmidget</h1></marquee>

i noticed u spelled marquee at the beginning marqee…would that effect it?

no just misspelled it. srry its fixed it.

It's nothing. Well, you now have little information about the box you are trying to attack.

Yay.