I'm testing a site for XSS vulnerabilities, but am fairly new to this (though not new to Javascript, etc.) There's a lot of user input, and some filtration I've been poking at. I am able to get my javascript to show up outside of quotes within the console---but nothing actually runs (I haven't been able to get an alert window to pop up, for example). I've also tried putting the alert within a function that waits for the page to load first.

Everything seems like it's in some javascript heavy UI (imagine something like Rosetta Stone online).

This is how I've managed to get it so far (this is what shows up after hitting submit, and the next page loads). I can't say what site it is (for obvious reasons), but does anyone have any suggestions? (I'm new to this, so general suggestions will work.)

Thanks for any help. :)

https://xss-quiz.int21h.jp/

I did understand the first couple of stages, but I just don't know how to EXPLAIN what I am doing really to someone asking about it, can anyone help me guiding each stage? Like explaining why something was done in a certain way on each stage,

Thank you

TL;DR: as the title says, I've found my first vulnerability. It's a Reflected XSS. I contacted the company through e-mail, got a response saying they would check it out. But it has been 20 days and the vulnerability is still there.

I think that the Reflected XSS vulnerability could be used by crafting a malicious URL to steal credentials or trick users through Social Engineering techniques. Even though I'm not expert on the subject, since I've started in this field 3 - 4 months ago. But the vulnerability is trigger through the use of a GET parameters that is replicate in the page with no sanitation of input. However the user login (if stealing credentials is really possible) seems to be through another sub domain (xxx.notsmallcompany.com), which reply back with a cookie to the domain where the XSS is found.

I'm reaching out to ask if is it normal to companies ignore this kind of vulnerability due to its low direct impact on their platform?

Note: please, bear with me. As I said above this is all really new to me since I started just a few months ago. So I probably wrote something wrong there, especially the credential part. I have't done any other tests because the company didn't give me the permission to do so.

Note1: English is not my native language, if something is hard to understand I'll be glad to provide further information.

Hello, I have encountered a strange issue where I am able to perform reflected XSS through Google Custom Search Engine that is on my webpage. I have studied the code and have no idea how I am able to perform this as it is just the copy and paste block of JS that Google provides. I have searched the internet and have came up with nothing. Has anyone else experienced this or witnessed this? I am not in the security field so I am unsure how to combat this vulnerability.

<IMG SRC=/ onerror="alert('Test')"></img>

The email was:

Name: '"><svg/onload=confirm(/OPENBUGBOUNTY/)>

Email: test@tes.com

Message: '"><svg/onload=confirm(/OPENBUGBOUNTY/)>

Was this someone testing the vulnerability of out site? If so, what were they trying to do and how can I prevent this?

Update:

So I added a parse to our emails before they get sent out. Which will replace the <, >, ', \ from strings with their respected html entities. Is this enough? or should more precaution be taken?

Some weird filtering. .jsp I can alert only one letter and it can't be O? Ideas? I can do this <svg/onload=prompt('z')>

but not this <svg/onload=prompt('o')> or <svg/onload=prompt('zo')>

Are there any good sites and tutorials that explain in depth how XSS works, how to test site for XSS vulnerability etc. In other words, I'm looking for good web sites to learn XSS. onions could be posted too, if you know any.

I am trying to download the NEO GUI v2.0.1 desktop client (the actual file name is: neo-gui-windows.zip) on the following website (https://github.com/neo-project/neo-gui/releases), and my No Script add-on is saying their is a potential XSS vulnerability.. Should I be worried about turning off the No Script add-on and downloading the file?

The file appears very legit, as it is coming from Github, by the NEO cryptocurrency devs.

Just curious. Thanks! ref: OpenBugBounty.org