Pecl bbcode xss

XSS on Yaari.com

http://digitalpbk.blogspot.com/2007/04/xss-on-yaaricom.html XSS on Yaari.com Lots of friendship network sites are coming up these days following the success of orkut. Another one supposedly originating from the same stanford university is yaari.com targeted at mainly Indian users. The site looks and functionality seems fine but is full of XSS holes (Cross Site Scripting). Almost all the fields can be bugged. Only thing that amazes me is that the site has used PHP. PHP has such a wonderful list of functions that can take care of the XSS problem. I wonder ...

XSS on JustDial.com

http://digitalpbk.blogspot.com/2007/04/xss-on-justdialcom.html XSS on JustDial.com JustDial.comSaw the ad a few days back on the TV, so thought could play with it. As expected, they haven't thought/bothered about Cross Site Scripting !Just search for our usual keyword : alert("XSS"); and you can get alerts.The reason for most XSS holes is due to the use of Microsoft's Active Server Pages (ASP). ASP does not have much default functions or modules to combat XSS. Whereas PHP has a number of functions to do the same.Happy Hacking ... ...

Mall Blog XSS in Comments

http://digitalpbk.com/2009/12/mall-blog-xss-html-comments Mall Blog XSS in Comments So you came from the The MALL blog, this is because of opened out HTML comments on the MALL blog. The MALL blog has full html support in its comments, which is a dangerous feature. More sites : www.eatsleepandcode.com www.layt.net mature-ip.eu : Any nodes can be edited on this site, wierd!!! Fix it ASAP XSS Security ...

Introduction to XSS Part 1

http://digitalpbk.blogspot.com/2006/12/introduction-to-xss-part-1.html Introduction to XSS Part 1 This document is purely for illustrative purposes only. I am not responsible for any losses arising to the websites mentioned below. Webmasters please be more alert...What is it?XSS stands for cross site scripting (CSS) Since CSS is already taken by Cascaded Style Sheets, it is named XSS X standing for a Cross. It is a kind of hacking which allows you to deface websites, loggin as another user etc. IntroductionLet us start by looking how websites work. Starting ...

Wordpress nextGEN gallery XSS (Cross site scripting) Cookie Stealing Vulnerability

http://digitalpbk.blogspot.com/2009/07/wordpress-nextgen-gallery-xss.html Wordpress nextGEN gallery XSS (Cross site scripting) Cookie Stealing Vulnerability IntroNow I need not tell what actually an XSS is, for that refer to here. To see what I mean check out the links given below. If you are using NextGen wordpress plugin, you are probably infected.the VulnerabilityThe vulnerability on this wordpress plugin is seen in the pid, album, gallery GET variables. http://www.example.com/wordpress/next-gen-gallery/?album=1&pid=3&gallery=2The GET variables on most ...

XSS - Part 2 (Cookie stealing and Defacement)

http://digitalpbk.blogspot.com/2006/12/xss-part-2-cookie-stealing-and.html XSS - Part 2 (Cookie stealing and Defacement) Please note that this article is for educational purposes only, and is targeted at webmasters who have never seen this scenario. Please donot harm anyone. Disclaimer : I am not responsible for any damages arising due to methods specified in this page. Webmasters please fix it ASAP.In the first part we injected javascript successfully, and we got an alert. Now let us move to step 2 , defacing and cookie stealing.Cookie Stealing using XSSCookie ...

XSS on GrazeIt.com

http://digitalpbk.blogspot.com/2007/01/xss-on-grazeitcom.html XSS on GrazeIt.com Recently while grazing over the net, I found this site grazeit.com. This is a site which keeps a database of good websites found on the net by netizens. But there is an XSS hole (Cross site scripting ) on the site which allow users to redirect the page to any desired location.Of course this hack does not work on the secure browser Mozilla Firefox. If you are not using Firefox, download for free (The link is given bottom right).Probably you arrived at this page from grazeit ...

Protect yourselves from phishing

http://digitalpbk.blogspot.com/2007/01/get-smart-against-phishing.html from compromised sites due to poor design. One experience I had is with a feedback form on a site which mails the feedbacks to me. Now some spammer creatively modified the feedback text so that the mail was sent to many!. Now thats a security risk!So we must be careful when designing such systems, what I did was to replace the @ symbols in the feedback form with "(at)". Now that has stopped the spams from getting through to others. Another poor design comes when there is XSS (Cross Site ...