Чаты Ochen strannij "chat"

Discussion in 'Веб-уязвимости' started by Nemez, 18 Jan 2004.

  1. Nemez

    Nemez New Member

    Joined:
    19 Dec 2003
    Messages:
    47
    Likes Received:
    0
    Reputations:
    0
    Chat:

    Propuskaet vse znaki, vplot do <>.
    Razresheni tegi:
    <font face="">
    <font color="">
    <font size=""> (do 4)

    Kazhetsja vsjo ochen lehko tak?
    No nepravda ...

    Size="" posle 4 chetirjoh zakrivaetsja znakom ` ...
    Esli zaiti s parametrami <font size=`> To ti prosto isparishsja,
    Buddesh v liste, no na kanale budesh prozrachnim  [​IMG]

    Zvet propuskaetsja kak #000000 tak i slovamai naprimer: Red.
    Stavish ` tozhe samoe kak i s size="".

    Esli pitaeshsja zackinut script

    Pishesh :

    Javascript:alert ....

    To v html ono vigledit tak:
    j:alert

    Poluchjaetsja on sjedaet slovo ...

    Pri vhode v chat est toka odno pole v voda nicka.
    Chat sdelan na http:
    T.E Adress xx.xx.xx.xx:xxxx ili tipa tokovo ...

    Tak vot vopros vozmozhno li oboiti, eti vse vstavki i poedanie slov???



    P.S: NA shol stranizy otkuda loginnjaza Admini  [​IMG]  [​IMG] [​IMG]
    Tak tam nado Nickname + Paasword, i plus tebja na IP proverjajut tipa ob ti tot admin ili net  [​IMG]

    Vaashe her poimjosh ....


    Esli kto chjo znaet pomogite pleassee

    Zaraneje spasibo  [​IMG]
     
  2. Algol

    Algol New Member

    Joined:
    29 May 2002
    Messages:
    1,759
    Likes Received:
    4
    Reputations:
    0
    </span><table border="0" align="center" width="95%" cellpadding="3" cellspacing="1"><tr><td>Цитата (Nemez @ января 18 2004,03:50)</td></tr><tr><td id="QUOTE">Javascript:alert ....

    To v html ono vigledit tak:
    j:alert

    Poluchjaetsja on sjedaet slovo ...[/QUOTE]<span id='postcolor'>
    Конечно съедает))
    Если бы все так просто было &nbsp;[​IMG]

    Куда кстати ты это &quot;Javascript:alert ....&quot; &nbsp;вставлешь то ?

    Попробуй вместо &nbsp;javascript другие языки. Например &quot;VBScript:alert()&quot; . Веб мастера часто забывают, что помимо джаваскрипта есть еще пару языков &nbsp;[​IMG]
     
  3. Nemez

    Nemez New Member

    Joined:
    19 Dec 2003
    Messages:
    47
    Likes Received:
    0
    Reputations:
    0
    Koroche budu kratok, islazhy swojo mnenie a ti Algol kak uchitel  [​IMG] Skazhesh pravelno u menja misl idjot ili net  [​IMG]

    Vot tak vigljadet soobshenie v chate:

    &lt;font size='1'&gt;&lt;table width=100%&gt;&lt;tr&gt;&lt;td&gt;(06:52[​IMG]6) TEXT :&amp;nbsp;&amp;nbsp;TEXT&lt;font size=`'&quot;1&quot;'`&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;&lt;hr&gt;&lt;font size='&gt;&lt;P&gt;

    Vot ja poslal teg &lt;font size=30&gt;

    &lt;font size='1'&gt;&lt;table width=100%&gt;&lt;tr&gt;&lt;td&gt;(06:52[​IMG]6) TEX :&amp;nbsp;&amp;nbsp;&lt;font size=30&gt;TEXT&lt;font size=`'&quot;1&quot;'`&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;&lt;hr&gt;&lt;font size='&gt;&lt;P&gt;

    Bukwi ostalis takiezhe, tolko nemnogo potolstele kak s tegom &lt;b&gt;
    Moja misl:
    Kakoito iz etih tegov &lt;font size=`'&quot;1&quot;'`&gt; &amp; &lt;font size='&gt;
    Nepropuskaet moju size  [​IMG]

    Probival poraznomy:

    &lt;font size=`'&quot;30&quot;'`&gt; TEXT &lt;font size='30'&gt; TEXT
    &lt;font size=`'&quot;30&quot;'`&gt; &lt;font size='&gt; TEXT &lt;font size=30'&gt; TEXT
    &lt;font size=`'&quot;30&quot;'`&gt; TEXT &lt;font size=30'&gt; TEXT
    ...

    Nefiga nevihodit [​IMG]

    No v chate est prikol ... on tegi s img propuskaet  [​IMG]

    ESli koroche postavish shtob mona bilo kartinki smotret, to bush ih videt...
    A esli net to na ekrane budet prost &quot;[pic]&quot; vihodit ...


    No teg &lt;img&gt; PROPUSKAET!
    Znachit mona skriptov nakidat  [​IMG]

    Proveril ja na VBS ne sjel, no tegi tipa:

    style=background-image:url(javascript:alert('приветик_всем_!!&#39[​IMG])

    Ne katjat, potomushto slovo style tozhe havaet ..

    T.E:
    Tipa teg &lt;font style=font-size: 350;&gt; ne prokatjat  [​IMG]

    A kak script v teg &lt;img src=...&gt; Zasunut ja poka neznaju...

    Esli chjoto eshjo nado raskazhy ...

    A teper hochy uslishat otwet, kak moja mislja to? [​IMG]
     
  4. Nemez

    Nemez New Member

    Joined:
    19 Dec 2003
    Messages:
    47
    Likes Received:
    0
    Reputations:
    0
    TAk chjo Algol?

    Kak maja mislja??? &nbsp;[​IMG]

    I prosba, nemog bi objasnit kak vstavit script bez tega &quot;style&quot;?
    Mozhno ego prosto v img pihnut???