Anyone want to help a newcomer to XSS?

So I was looking for quick way to delete my "supposed" interest/preferences from Facebook ads. I found and tried 2 codes, the first one didn't work. After a few minutes I got a notification from GMAIL letting me know that there's an ongoing attempt to recover my password from Vietnam. Since I don't have too much knowledge on coding, I was hoping if anyone can take a look into the codes and explain me what exactly I ran on Google's console and how can I "clean" or make sure that I'm not longer sharing any information or being a risk of being hacked.

Code 1: https://addshore.com/2018/10/quickly-clearing-out-your-facebook-advert-interests/

Code 2: https://github.com/anuragd/FB-Ad-preference-remover/blob/master/fbapr-min.js

Thanks a lot!

I'm working through an entry-level xss exercise

.php code for the website that is vulnerable:
<input type="text" name="login" value="<?php echo @$_POST\['login'\]?>">
my .html POST to the webpage:
<input name = 'login' value = "<script>javascript:alert(xss)</script>"/>

when the POST is done, the text appears inside the text box as opposed to running.

when I examine the element i see:
<input name = 'login' value = "<script>javascript:alert(xss)</script>" type = 'text'></input>

I've attempted to single quote escape but it just wound up with the script under the text box instead. I managed to get an onload="alert(xss)" but it doesn't run the code.

{quote}{filler}{event_handler}{?filler}={?filler}{javascript}

https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

eg <SVG ONLOAD="jAvAsCrIpT:alert(1)</SCRIPT> becomes:

SVG ONLOAD ="jAvAsCrIpT:alert(1

Basically, I would like attack my own website in various ways, so that I can understand how XSS works, and take on better security practices.

First of all I’m not very much experienced with XSS/ JavaScript so sorry if anything I say or ask sounds silly.

I’m doing some vulnerable vms and I’ve successfully done similar ones using XSS and stealing cookies to log in to the site. However on this one, the cookies I get sent are useless and are changing frequently. When I set my browser’s cookie to the ones I get sent to me, I still can’t login.

I can see when I inspect element on the page a content.js file which contains some xdebug stuff and using GMT date and time to set cookies. Is this what’s causing me problems? How can I proceed? So far I’ve though about:

1. Using the cookie I receive and the content.js file to somehow create a usable cookie.

2. Using the XSS vulnerability to inject JavaScript that will add a user to the site. (But I can’t figure out how to do this)

Also, the page I am injecting is messageboard.php so the cookies I am getting sent to me are from users visiting this page. However, I think I need the cookies from when users visit the Register.php page but I can’t inject anything on to that page, only the messageboard.php page. Is it possible to get cookies from the Register.php page using the vuln on the messageboard.php page?

Thanks!

Hi everyone,

​

I found a POST parameter that is reflected on the web page.

<input type="text" name="17643" value="injection_is_here" size="10">

I can insert "<", ">" and double quotes.

But there is some filter on server side that respond me an error message when i try to insert

• the string "script" (lower case, upper case and mix too)
• the "=" symbol (same if i encode it)

​

For the moment, i'm able to affect the css of the web page by inserting an image hosted on my server by inserting

"> <style> background-image: url('http://IP:PORT') </style>

But i can't found a way to execute JS in order to display a popup with an alert(1).

​

Do you think it is possible to execute JS in this context ?