Help hacking Guestbook

Hello,

I have been playing around with this guestbook application lately, and I think its vulnerable to XSS. I'll explain:

I first tried

<script>

in the comment box, and after quite anumber of tests, I figured, it won't allow the word <script>, or even <s. So to make a long story short, I have figured a way around this by "HTML entities encoding" the <script> string, so it passes, so I submitted:

<script language = "Javascript">alert('Hello');</script>

So that managed to get past the filter, but when I viewed the guestbook, the string:

<script language = "Javascript">alert('Hello');
 </script>

why was there in plaintext, why didn't the application interpret and output it as javascript? Also it allows images too, is there anything I can do with that?

Thanks.

The first javascript example was supposed to be encoded, guess this board did the same..

Double post..

Are you sure that HTML is allowed?

Type something like

markup<b>Cool</b>site!

If Cool is in bold..then i can't help you any further, if it is not in bold, then i still cant help you any further.

if they have tags like we have here using markup ** bold ** and such, you can find a way to escape that…or use the url one to make a javascript url that automatically redirects or something

Thanks for the replies, yes they allow HTML, you can choose between that and plain text, I'll just play around with it a bit more, if you want, PM me and I'll give you the URL, and we can work on it together. Thanks anyways.

if they use tags like [b] instead of <b> What do you do?

i found xss vunrability in a search engine that enables javascript and html injection. and i dono wer to go further with it too, what scripts/commands should i inject?:|

If you need help hacking a guestbook then you need help with your ability to learn and grasp concepts …

-The_Flash- wrote: If you need help hacking a guestbook then you need help with your ability to learn and grasp concepts … true that

Well, what I mostly do (and its freaking awesome) is if they have HTML allowed is this: markup<img src="blah.gif" onerror="alert('hi')">

From there you can redirect, ect.