Waraxe IT Security Portal

Hanna313 · Active user

Hello,

I found a website which is vulnerable to XSS.
It is a webshop, and customers can check the status of their order by a login.
So I think that the login time is only temporarily.

When I enter this in a searchbox <script>alert("test");</script>
the website gives a pop-up which says "test".

The website doesnt add this to the URL but gives a output in the title of the browser.

I dont know what else I can do/try now, so maybe you people could give me some ideas/suggestions of what I can input and the results I can get.

Thanks in advance, Hanna

Cro · Beginner

I don't know XSS much but you should learn it by tutorials, only things I know u can spreed your trojan/rat etc. And some things with cookies etc. View some tutorials Smile

Hanna313 · Active user

Yeah I did but they aren't very clear about how to exploit a XSS vulnerability.

So maybe someone personal has a suggestion...

Cro · Beginner

where did u learnd it ? try to read some papers in milw0rm..

lunarbeam · Beginner

Pretty basic stuff, but might help:

Full Disclosure - XSS Part 1

Hanna313 · Active user

Thanks, these videos look very helpful!