393 reputation
110
bio website
location
age
visits member for 2 years, 2 months
seen Dec 23 '13 at 0:49

Just a person.


Apr
25
comment Dom xss posibility question?
Thanks you , now I can implement it in code. And thanks for links , I tried Dominator but got nothing, but tools make mistake so I asked.
Apr
11
comment What are good tools for CRLF discovery?
this acunetix.com/websitesecurity/crlf-injection
Mar
2
comment Is it possible to exploit XSS inside User-Agent header?
Thanks , seems like there is no way , now . I've downloaded the tool and downgraded my flash player , just to test it.It works great.Thanks
Mar
2
comment Is it possible to exploit XSS inside User-Agent header?
There is a cross site scripting on mobile version of that site , it is showing my user-agent inside source code.So when I use temper data I can change user-agent to "><script>alert(0)</script> and crate javscript alert. But how to request for that page with spoofed user-agent without need to use temper data?
Feb
2
comment Finding all AJAX entrypoints
Ali fix link for crawljax.com :) Also : youtube.com/watch?v=rYAO94GnBlY
Jan
1
comment How can this xss challenge be solved?
Thanks the jquery one gave me a real headache , but three of 5 for a beginner is not bad, and btw nice challenge.
Dec
28
comment How can this xss challenge be solved?
Thanks , I think first three were easy but others will be very hard , will try my best. Hvala
Dec
28
comment How can this xss challenge be solved?
I have updated my thread , just want to know how can I access those values. Thanks
Dec
28
comment How can this xss challenge be solved?
I have updated my thread , just want to know how can I access those values. Thanks
Dec
26
comment How I add cookie to w3af for authenticated attacks?
Thanks for advice , I used skipfish and wasn't very satisfied , but I like wapiti really useful . Thanks
Dec
6
comment Need an explanation of Cross-Site Flashing?
So if user input is reflected anywhere inside these dangerous parameters , than XSS can be exploited.Since GET is not an option.
Dec
6
comment Need an explanation of Cross-Site Flashing?
So if attacker finds url like this : demo.testfire.net/vulnerable.swf?loadMovieNumVar=XSS he can try to exploit xss issue?
Nov
28
comment I need explanation on how serious these vulnerabilities are?
Yes that is what I want to know I don't want to tell system admin : "Hey you have vulnerability , I can show my picture on your site" , seems kind of funny :) . Is there any way that this kind of "vulnerability" can be exploited any further. Seems like no other files can be included .
Oct
31
comment How to show xss alert box when you are inside function in <script> tag?
Thanks for answering ,it seems that sometimes repairing broken function works and sometimes not. Thanks you gave me an idea.
Oct
23
comment CSRF over post request without redirection?
did it , messed up iframe css values so it didn't show anything.Thanks for help.
Oct
23
comment CSRF over post request without redirection?
How do I do that?
Oct
23
comment CSRF over post request without redirection?
I know that requests can be forged , I just wanted to know how to submit forged page post parameters without user knowing it , forging get request is easy but if you forge post request you get redirected.
Sep
5
comment XSS inside CSS when " is encoded?
No , well I tried with <> and they are filtered (hexed) , and the solution you gave didn't work , thanks anyway.It seems I cant do anything. Btw, if you want to give it a try , this is my email maxonebt4@gmail.com , jyst email me and I'll give you site location.
Sep
5
comment XSS inside CSS when " is encoded?
This : <style type="text/css"> body { margin: 0; padding: 0; background-color: #EFEFEF; overflow: hidden; font-family: Arial, Helvetica, sans-serif; } shortened cos of text limit..... ... ... </style>
Sep
5
comment XSS inside CSS when " is encoded?
Here is what I'm dealing with : pastebin.com/EkRCwMCc . Is there any way to get this xss working on mozzila.Thanks