Need help exploiting a website

Printable View

10-09-2015
robater

Need help exploiting a website

So I found a vulnerability on a website that if I found an exploit to would be gg no re. I was wondering if anyone was experienced with scripting and would tell me whats my next step. If I try to do anything with <script> or any evasion shit from here it just shows a blank page and no alert shit.

Basically I can run all html except for a few like iframe. If anyone has any ideas to exploit this let me know by replying /gewd

This is what I have so far:
https://i.gyazo.com/98243f31fbce34f5...bc7791a75b.png

This is what I did to get this:

Code:

https://website.com/kek/kek/kek.do?key=<img%20src="https://i2.kym-cdn.com/photos/images/newsfeed/000/960/777/2b7.jpg"%20alt="Mountain%20View"%20style="width:304px;height:228px;">%20<br>%20<h1>dank%20memes%20cant%20melt%20steel%20beams</h1>
10-09-2015
Nyaro

I would actually post this in the general hacking section
10-09-2015
Gill Bates

Quote:

Originally Posted by robater

So I found a vulnerability on a website that if I found an exploit to would be gg no re. I was wondering if anyone was experienced with scripting and would tell me whats my next step. If I try to do anything with <script> or any evasion shit from here it just shows a blank page and no alert shit.

Basically I can run all html except for a few like iframe. If anyone has any ideas to exploit this let me know by replying /gewd

This is what I have so far:
https://i.gyazo.com/98243f31fbce34f5...bc7791a75b.png

This is what I did to get this:

Code:

https://website.com/kek/kek/kek.do?key=<img%20src="https://i2.kym-cdn.com/photos/images/newsfeed/000/960/777/2b7.jpg"%20alt="Mountain%20View"%20style="width:304px;height:228px;">%20<br>%20<h1>dank%20memes%20cant%20melt%20steel%20beams</h1>

Download Low Orbit Ion Cannon, in the payload message type "Get AdminCP Password [insert website here]" (this will get the Admin's password to hack the site)
Put it on maximum settings for maximum effect and DO NOT use a VPN, just use your normal IP.
Once launched, you will be able to take over the website completely, since you will have the password./gewd
10-09-2015
Schuba

Quote:

Originally Posted by Gilly Bates

Download Low Orbit Ion Cannon, in the payload message type "Get AdminCP Password [insert website here]" (this will get the Admin's password to hack the site)
Put it on maximum settings for maximum effect and DO NOT use a VPN, just use your normal IP.
Once launched, you will be able to take over the website completely, since you will have the password./gewd

Sorry if I'm ruining your well thought out joke here (because I didn't get it boh1)
Isn't LOIC a piece of shit? o;
10-09-2015
robater

Quote:

Originally Posted by Gilly Bates

Download Low Orbit Ion Cannon, in the payload message type "Get AdminCP Password [insert website here]" (this will get the Admin's password to hack the site)
Put it on maximum settings for maximum effect and DO NOT use a VPN, just use your normal IP.
Once launched, you will be able to take over the website completely, since you will have the password./gewd

instructions unclear and got a swat team at my house
(ot: any serious ideas?)

- - - Updated - - -

Quote:

Originally Posted by Schuba

Sorry if I'm ruining your well thought out joke here (because I didn't get it boh1)
Isn't LOIC a piece of shit? o;

He was joking lol
10-09-2015
Schuba

Quote:

Originally Posted by robater

He was joking lol

Okay cool, I thought so but I was having a moment.
10-09-2015
Gill Bates

Quote:

Originally Posted by robater

instructions unclear and got a swat team at my house
(ot: any serious ideas?)

- - - Updated - - -

He was joking lol

Try to look for online tutorials: Youtube, Google, Pen Testing forums, etc.