|
|
Author |
Message |
Dragonelf
Group: Retired Moderators Joined: 11 Mar 2009 Donor: Posts: 4584 Gold: 63.50 Clan: Legends
Status: Warn: Reputation: 154
|
#1 Posted: 13 Oct 2011 06:03 am Post subject: Very dangerous xss, even displays in the profil |
|
|
http://www.d3jsp.org/profile.php?mode=viewprofile&u=7149
xss in the name field of the character
could be used to redirect people to another webpage, read their cookies and redirect them back here
they wouldnt even notice you got their cookies
with their cookies you can log in their account and do whatever you want
Last edited by Dragonelf on 13 Oct 2011 06:48 am; edited 1 time in total |
|
Back to top |
|
|
Jay
Group: Scammer Joined: 21 Oct 2008 Donor: Posts: 1823 Gold: Locked
Status: Warn: Reputation: 20
|
#2 Posted: 14 Oct 2011 06:00 pm Post subject: |
|
|
i see this hasnt been fixed yet? or has it? _____________________
[img]https://imgur.com/XAmdaAZ[/img]
PM Me if you have any questions |
|
Back to top |
|
|
|
|
Dragonelf
Group: Retired Moderators Joined: 11 Mar 2009 Donor: Posts: 4584 Gold: 63.50 Clan: Legends
Status: Warn: Reputation: 154
|
#3 Posted: 14 Oct 2011 06:15 pm Post subject: |
|
|
not yet, but tramway pmed me his working on that |
|
Back to top |
|
|
Jay
Group: Scammer Joined: 21 Oct 2008 Donor: Posts: 1823 Gold: Locked
Status: Warn: Reputation: 20
|
#4 Posted: 14 Oct 2011 06:17 pm Post subject: |
|
|
ahh cool, thanks for reporting that, that could of done some damage lol
Last edited by Jay on 14 Oct 2011 06:17 pm; edited 1 time in total _____________________
[img]https://imgur.com/XAmdaAZ[/img]
PM Me if you have any questions |
|
Back to top |
|
|
Dragonelf
Group: Retired Moderators Joined: 11 Mar 2009 Donor: Posts: 4584 Gold: 63.50 Clan: Legends
Status: Warn: Reputation: 154
|
#5 Posted: 14 Oct 2011 06:21 pm Post subject: |
|
|
Jay wrote: | ahh cool, thanks for reporting that, that could of done some damage lol |
1. create new account
2. make the cookiestealer in ur profile
3. pm mod "Hey my profile is bugged can u tell me whats wrong?"
4. F5ing my page till I got his cookie
5. Delete the cookiestealer in my profile
6. Log in mods account with proxy
7. Wait untill he logs off
8. Scam someone
9. Ban the victim
Repeat step 8-9 till acc get banned / pw changed
10. Get next mod account
Repeat 8-10 till the hole get fixed
------
Guess I wouldve been able to make some k fg with that |
|
Back to top |
|
|
Jay
Group: Scammer Joined: 21 Oct 2008 Donor: Posts: 1823 Gold: Locked
Status: Warn: Reputation: 20
|
#6 Posted: 14 Oct 2011 08:34 pm Post subject: |
|
|
haha kinda seems you put some thought into this :p _____________________
[img]https://imgur.com/XAmdaAZ[/img]
PM Me if you have any questions |
|
Back to top |
|
|
Dragonelf
Group: Retired Moderators Joined: 11 Mar 2009 Donor: Posts: 4584 Gold: 63.50 Clan: Legends
Status: Warn: Reputation: 154
|
#7 Posted: 14 Oct 2011 08:47 pm Post subject: |
|
|
yes but I am a white knight and report stuff like that instead of getting $$$$ |
|
Back to top |
|
|
Jay
Group: Scammer Joined: 21 Oct 2008 Donor: Posts: 1823 Gold: Locked
Status: Warn: Reputation: 20
|
#8 Posted: 14 Oct 2011 08:49 pm Post subject: |
|
|
only way to live! _____________________
[img]https://imgur.com/XAmdaAZ[/img]
PM Me if you have any questions |
|
Back to top |
|
|
NothingButaPeanut
Group: Members Joined: 05 Jun 2011 Posts: 643 Gold: 354.20 Clan: Honor
Status: Warn: Reputation: 43
|
#9 Posted: 15 Oct 2011 01:06 pm Post subject: |
|
|
well, hopefully this site uses more than a cookie when a user clicks "remember me"...
Maybe an ip check or something to prevent people from hacking an account with only the cookie. |
|
Back to top |
|
|
Dragonelf
Group: Retired Moderators Joined: 11 Mar 2009 Donor: Posts: 4584 Gold: 63.50 Clan: Legends
Status: Warn: Reputation: 154
|
#10 Posted: 15 Oct 2011 01:53 pm Post subject: |
|
|
NothingButaPeanut wrote: | well, hopefully this site uses more than a cookie when a user clicks "remember me"...
Maybe an ip check or something to prevent people from hacking an account with only the cookie. |
The ip changes every 24 hours usually
There isnt more than a cookie to recognice you
It would even work on ebay, if ebay had a xss hole |
|
Back to top |
|
|
NothingButaPeanut
Group: Members Joined: 05 Jun 2011 Posts: 643 Gold: 354.20 Clan: Honor
Status: Warn: Reputation: 43
|
#11 Posted: 15 Oct 2011 03:03 pm Post subject: |
|
|
well im sure they log the ip, location area, isp or something and store it in a db. Then match the login attempt/cookie check with the last known login?
Is a cookie seriously all that's required? |
|
Back to top |
|
|
NothingButaPeanut
Group: Members Joined: 05 Jun 2011 Posts: 643 Gold: 354.20 Clan: Honor
Status: Warn: Reputation: 43
|
#12 Posted: 15 Oct 2011 03:05 pm Post subject: |
|
|
bleh doublepost
Last edited by NothingButaPeanut on 15 Oct 2011 03:05 pm; edited 1 time in total |
|
Back to top |
|
|
Dragonelf
Group: Retired Moderators Joined: 11 Mar 2009 Donor: Posts: 4584 Gold: 63.50 Clan: Legends
Status: Warn: Reputation: 154
|
#13 Posted: 15 Oct 2011 05:09 pm Post subject: |
|
|
NothingButaPeanut wrote: | well im sure they log the ip, location area, isp or something and store it in a db. Then match the login attempt/cookie check with the last known login?
Is a cookie seriously all that's required? |
They dont do it, beacause it would be stupid
1. you could log in from a friend
2. from a internetcafee
3. from your vacation
etc.
cookie is all whats required |
|
Back to top |
|
|
Viscosity
Group: Scammer Joined: 07 Jul 2011 Donor: Posts: 1000 Gold: Locked
Status: Warn: Reputation: 26
|
#14 Posted: 15 Oct 2011 07:21 pm Post subject: |
|
|
Hi toy ou too! _____________________
|
|
Back to top |
|
|
|