xss with chrome?

hpprinter100 · Post by **hpprinter100** » 09 Feb 2010, 10:52

when i try and do an xss with chrome it blocks javascript , so what can i use instead of javascript that wont get blocked?

Post by **ayu** » 09 Feb 2010, 11:07

Chrome doesn't know that it's an XSS. XSS works because it's legal syntax, and I don't think Chrome would block that.

Maybe it's the site you're trying to exploit?

hpprinter100 · Post by **hpprinter100** » 09 Feb 2010, 12:58

http://www.teachtoday.eu/en/Search-Resu ... /script%3E

works in firefox but not chrome or IE , guess xss is getting wised up to.

Post by **ayu** » 09 Feb 2010, 13:32

oh, you're right, IE did block it

Didn't know it did that.

"Internet explorer has modified this page to help prevent cross site scripting"

Guess it simply checks for any kind of executable code in the vars that normally shouldn't be there.

I played around with it a little, found some interesting info here

Code: Select all

http://www.securiteam.com/windowsntfocus/6Z00C15NFW.html

Do tell if it works

hpprinter100 · Post by **hpprinter100** » 09 Feb 2010, 15:39

im still messsing about with it , found this thou http://openmya.hacker.jp/hasegawa/publi ... =datae.txt

Post by **ayu** » 09 Feb 2010, 15:44

hpprinter100 wrote:im still messsing about with it , found this thou http://openmya.hacker.jp/hasegawa/publi ... =datae.txt

oh, that's really neat =o

Kirk · Post by **Kirk** » 11 Feb 2010, 20:39

I am trying to figure out what this is so I can find a conversion table to learn it. I know it is XSS but i want a table so I can figure out what %29, %3c, etc converts too.

?q=%3Cscript%3Ealert%28%22lol%22%29%3C/script%3E

Post by **ayu** » 12 Feb 2010, 01:25

Kirk wrote:I am trying to figure out what this is so I can find a conversion table to learn it. I know it is XSS but i want a table so I can figure out what %29, %3c, etc converts too.

It's ASCII in hexa decimal representation

Code: Select all

http://www.asciitable.com/

Post by **bad_brain** » 12 Feb 2010, 05:28

also check here Kirk:
http://ha.ckers.org/xss.html

on the bottom, "Character Encoding Calculator"...

Kirk · Post by **Kirk** » 12 Feb 2010, 22:54

I thought it was ASCII. THis is what i want to do. I want the entire URL to be written in ASCII. so instead of

?q=%3Cscript%3Ealert%28%22lol%22%29%3C/script%3E

I also want the "lol" part to be in ASCII also. it is not working for me though. I tried removing the "lol" part and inserting the letter C ("&#67") but then I get no alert at all.

So my question is: how can i write something not in plain text and have it show up as plaintext when the alert box appears?

EDIT:

Never mind i solved it. I was trying to alter the URL after i brought up the web page. when I altered it before it worked just fine.