Web Hacking Taku XSS Handbook For HellOfHackers Members

[taku]

This Guide Was Written For HellForums in Old Days But It Is Still Valuable
Introduction​

This is going to be my official XSS handbook. I've written a XSS handbook on a different alias, but
decided to leave it due to it being used in too many databases.
Please note that this is not copied, because that would trace back to my old alias.

This handbook is now updated and fixed.

What is XSS?​

XSS, also known as cross-site scripting is a web vulnerability. It's caused when the user input
is not sanitized correctly, and is therefore executed.

Let's say there's a search box on a website. If you search for the word "cat" and press enter you'll
probably come to a second page where it says something like "500 results for the word 'cat'".
This means that the websites HTML is looking something like this.

<h1>500 results for the word 'cat'.</h1>

Now, let's say this website was vulnerable to XSS and you changed your input from cat to HTML code, it's
not sanitized correctly and is executed. Let's say you search for this instead: <script>alert('XSS')</script>.

Now the HTML code would look like this instead.

You must reply before you can see the hidden data contained here.

 

[dark_phonix]

This Guide Was Written For HellForums in Old Days But It Is Still Valuable
Introduction​

This is going to be my official XSS handbook. I've written a XSS handbook on a different alias, but
decided to leave it due to it being used in too many databases.
Please note that this is not copied, because that would trace back to my old alias.

This handbook is now updated and fixed.

What is XSS?​

XSS, also known as cross-site scripting is a web vulnerability. It's caused when the user input
is not sanitized correctly, and is therefore executed.

Let's say there's a search box on a website. If you search for the word "cat" and press enter you'll
probably come to a second page where it says something like "500 results for the word 'cat'".
This means that the websites HTML is looking something like this.

Now, let's say this website was vulnerable to XSS and you changed your input from cat to HTML code, it's
not sanitized correctly and is executed. Let's say you search for this instead: <script>alert('XSS')</script>.

Now the HTML code would look like this instead.
[Hidden content]

hi

 

[mrihani]

thx bro thx i like it

 

[vietdot]

Thank you so much for this sharing

 

[Dragoniarz]

thank very good post bro

 

[cyber_d_kdo]

Smsksk sksksksk skskskskks skskskks skskks

 

[CyberGod]

that was a good guide rep +++