20 matches found
xsshunter
DEPRECATED - TRY THE NEW EXPRESS VERSION See here for more info: https://github.com/mandatoryprogrammer/xsshunter-express XSS Hunter Source Code This is a portable version of the source code running on https://xsshunter.com. It is designed to be easily-installable on any server for security...
xsshunter-express
XSS Hunter Express 5분 안에 설정 완료, 유지보수 불필요 블라인드 크로스 사이트 스크립팅 취약점을 테스트하고 발견하기 위해 XSS Hunter를 설정하는 가장 빠른 방법입니다. 설정 5분 소요, 너무 대충 읽지 마세요 요구 사항 docker 및 docker-compose 설치 최소 2GB RAM을 갖춘 호스트 서버 IP에 매핑할 수 있는 호스트 이름예: host.example.com DNS 제어 권한 필요 이메일 알림용 XSS 페이로드 실행에 대한 이메일 알림을 받으려면 유효한 SMTP 자격 증명이 있는 이메일...
CVE-2021-41317
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...
MonsterInsights < 8.9.1 - Stored Cross-Site Scripting via Google Analytics
The plugin does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics. 1. Open a WP page with the plugin and Google analytics installed and search for somethi...
CVE-2021-41317
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...
CVE-2021-41317
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...
CVE-2021-41317
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...
Cross site scripting
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...
CVE-2021-41317
CVE-2021-41317 affects XSS Hunter Express; multiple connected sources confirm a failure to enforce authentication for paths prior to 2021-09-17, enabling unauthorized access and potential client-side code exposure. CVSS v3.1 base score 9.8 (HIGH/CRITICAL scope) with network attack vector and no p...
CVE-2021-41317
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...
CVE-2021-41317: Improper Authentication
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...
U.S. Dept Of Defense: Blind stored XSS due to insecure contact form at https://█████.mil leads to leakage of session token and
Summary: I have discovered a blind stored cross site scripting vulnerability due to an insecure Contact form available here https://███████.mil/ This form does not properly sanitize user input allowing for the insertion and submission of dangerous characters such as angle brackets. I was able to...
QIWI: HTTP Request Smuggling on api.flocktory.com Leads to XSS on Customer Sites
HTTP Request Smuggling is a technique to desync the sequence in which HTTP requests and responses are processed. This particular vulnerability abuses the CLTE variant of HTTP Request Smuggling as described in PortSwigger's blog. The domain api.flocktory.com was found to be vulnerable to this atta...
Zomato: [www.zomato.com] Blind XSS on one of the Admin Dashboard
Thanks for the report @pandaaaa. The Blind XSS fired when the order details were viewed by the admin at the back-end, The script was injected through an API endpoint from the Zomato app on one of the parameters which was recently introduced to provide special instructions to the restaurant on how...
Zomato: [www.zomato.com] Blind XSS in one of the Admin Dashboard
@sandeephodkasia identified a Blind XSS vulnerability that fired in one of our admin dashboard. POC - @sandeephodkasia added "alert0; XSS Hunter was used in this case in address field while placing an order. - XSS triggered when one of our support agent viewed the order details. Thanks...
Ubiquiti Inc.: Stored XSS in dev-ucrm-billing-demo.ubnt.com In Client Custom Attribute
Hey, Was Testing the subdomins when I came Accross the subdomain https://dev-ucrm-billing-demo.ubnt.com/ I logged in as an Administrator and while testing i added a User and In Client Custom Attribute 1 i added the Payload: """"/ and Save the Client and Then on client page i.e:...
XSS Hunter is Now Open Source – Here’s How to Set It Up!
Recently I opened up XSS Hunter for public registration, this was after publishing a post on how I used XSS Hunter to hack GoDaddy via blind XSS and pointed out that many penetration testers use a very limited alert box-based pentesting methodology which will not detect these types of issues. Aft...
GoDaddy Patches Blind XSS Vulnerability
Domain registrar GoDaddy fixed a vulnerability affecting systems used by its customer support agents that could have been abused to take over, modify or delete accounts. Researcher Matthew Bryant said that a riff on a cross-site scripting attack called a blind XSS was to blame. A GoDaddy customer...
XSS Hunter – A Modern Approach to Testing for Cross-site Scripting (XSS)
Cross-site Scripting XSS origins go arguably back to a lab in Microsoft in 1999. With the first disclosure of the issue titled “ Malicious HTML Tags Embedded in Client Web Requests “, this research sparked an entire generation of an attack that somehow still seems to persist in modern web...