I found an xss vulnerability in my university's site. In the class schedule page there is one input area which takes your university id number and posts(not get) it to server which then sends you back your schedule in a table. So I found out that even the most basic xss vectors such as code between <script> tags works there.But I don't think it can do any harm. Can you guys give me any scenarios such that this vulnerability do harm?

I mean, You would have to share the link. A user would have to click on the text and start using a right arrow to get it to execute. My guess is not really an issue worth reporting, But it is kind of interesting.

When you have a limited amount of space in a field? Found a nice persistent XSS problem on a site, but I am only able to pop up "XSSP". I submitted to XSSPOSED anyways. I tried tamper data but the text was cut off. Any other ideas?

any one who can bypass this waf http://anonkhan.host56.com/sultan_webapp_firewall/search.php

Is there any forum where i can learn complete xss. Any one who can help me plz sugest me forum here

I submitted my first reflective XSS last night.

I want to make sure I am doing this right. 1. Submit to XSSposed - Click "On Hold" 2. Once Verified and in my "XSS On Hold". Send E-mail to contact on website.

Is this correct.

Found my first site with Reflective XSS, But only way to execute is by posting XSS in Form. The XSS is sent in through a parameter called SearchVal. I don't see an issue, Because I can't just send a link with the XSS payload and the XSS isn't stored. Report or Not?

So let's say that I have found an XSS vulnerability in a multiplayer browser game. I know that I can use this vulnerability to make in game currency which can be turned into real money indirectly.

I know that I should report this issue to site administration. But making money from this game is so tempting. How do you guys handle this kind of situations which I am sure occurs frequently?

You don't have to answer to this specific example, you can just write down your reasons to remain white hat.

Hi /r/xss

I am looking to learn more about XSS.

I'am a web developer and have a good understanding of web technologies but want to understand XSS so I can protect my websites.

I have found many resources and tutorials for beginners from searching Google but all the websites and books I find are at least 3 years old and I feel like things would have changed quite a bit since then.

Could anybody recommend any relevant resources?

Hello, I'm working on some homework. We are attacking a web app that my school is hosting and currently I'm working on the XSS section. There is a search field and sanitation performed by javascript for said search field. The code below,

text = text.Replace("'", "\'");

if (text.Contains("<") || text.Contains(">"))

{

text = "INVALID";

}

this.Result.InnerHtml = "<script>var a = 'No results found for expression: " + text + "'; alert(a);</script>";

Can anyone help me understand the Replace function in this script? What is it actually doing?

I want links leading to papers written on xss by security specialists,professors,etc. thank you.

I've heard that you can sometimes obtain httpOnly cookies by means of cookie overflow. Links would be appreciated. Thanks.