[ralf93]

It deserves a thousand thanks bro. awesome work :thumbsup:
read it whole
always been a fond of XSS.
btw what if you find a simple HTML site with no search or comment bar?

[ralf93]

Mehehehe.. Got 4 FB accounts already! Some people are idiots

So u use a php script for facebook cookies? is the script different from this one (mentioned by Raccooncity) or the same?

[RaccoonCity_mybb_import13707]

It deserves a thousand thanks bro. awesome work :thumbsup:
read it whole
always been a fond of XSS.
btw what if you find a simple HTML site with no search or comment bar?

Well, in XSS you always have to change the website in anyway, for example in a search query or a comment.
If that comment section now is vulnerable, the code gets executed.

Even if there's no comment for example, there's always text.
Imagine a URL that looks like this:

Code:

www.website.wow/article.php?q=intrestingarticle

Now, if you were to change instrestingarticle to some HTML code like:

Code:

"><script>alert(1);</script>

you'll get redirected to a website that says that "The article "><script>alert(1);</script> was not found", and then the HTML gets executed and boom. XSS.~
That would work in some cases.

[Spirit]

Thank you for sharing this handbook with HC. This was a fantastic read! If it means anything to you, it's even one of those things people share with other people when they're looking to learn about something (XSS in this case). Honestly, this was written really well. I'll be giving this a "Thanks" when I'm not on mobile.

How long did it take you to write this exactly? Just wondering.

[RaccoonCity_mybb_import13707]

Thank you for sharing this handbook with HC. This was a fantastic read! If it means anything to you, it's even one of those things people share with other people when they're looking to learn about something (XSS in this case). Honestly, this was written really well. I'll be giving this a "Thanks" when I'm not on mobile.

How long did it take you to write this exactly? Just wondering.

Thank you! It does mean alot!

It took me a bit more than 1 day, I spent the night to start writing it and woke up and wrote the rest.
I'm glad you liked it

[problemsolva]

Thanks man this was
A really informative article to read.

[ralf93]

so how do you XSS a site who has no search and comment box and its links are like this example.com/contact.html
(sorry but im a noob at XSS)

[RaccoonCity_mybb_import13707]

so how do you XSS a site who has no search and comment box and its links are like this example.com/contact.html
(sorry but im a noob at XSS)

I explained this to @Jinxed before, but I can explain it again.

Let's say that the url looks like this:

Code:

www.example.com/contact.html

Now, if I would change contact.html to something random like:

Code:

www.example.com/ladkfgjlkajd

It would display a page saying that "ladkfgjlkajd" doesn't exist.
Okay, let's type some HTML in there.

Code:

www.example.com/"><script>alert(1);</script>

Now when it shows that "><script>alert(1);</script> doesn't excist, it will hopefully execute the payload.

[ralf93]

so how do you XSS a site who has no search and comment box and its links are like this example.com/contact.html
(sorry but im a noob at XSS)

I explained this to @Jinxed before, but I can explain it again.

Let's say that the url looks like this:

Code:

www.example.com/contact.html

Now, if I would change contact.html to something random like:

Code:

www.example.com/ladkfgjlkajd

It would display a page saying that "ladkfgjlkajd" doesn't exist.
Okay, let's type some HTML in there.

Code:

www.example.com/"><script>alert(1);</script>

Now when it shows that "><script>alert(1);</script> doesn't excist, it will hopefully execute the payload.

many thanks but i tried it and it gave me thir 404 error :p

Code:

Not Found The requested URL /"><script>alert(1);</script> was not found on this server.

[RaccoonCity_mybb_import13707]

so how do you XSS a site who has no search and comment box and its links are like this example.com/contact.html
(sorry but im a noob at XSS)

I explained this to @Jinxed before, but I can explain it again.

Let's say that the url looks like this:

Code:

www.example.com/contact.html

Now, if I would change contact.html to something random like:

Code:

www.example.com/ladkfgjlkajd

It would display a page saying that "ladkfgjlkajd" doesn't exist.
Okay, let's type some HTML in there.

Code:

www.example.com/"><script>alert(1);</script>

Now when it shows that "><script>alert(1);</script> doesn't excist, it will hopefully execute the payload.

many thanks but i tried it and it gave me thir 404 error :p

Code:

Not Found The requested URL /"><script>alert(1);</script> was not found on this server.

Yeah, sometimes people have cutomized 404 errors.
But this was just an example, there's more ways of doing it.