Learn More
Resend Email
49
Best office prank on you/from you?
Week 37 Group Rant
Skayo
8y

If found a Website with a nice Guestbook. Funny thing: HTML-Code and JavaScript-Code in the message was not getting escaped. So I wrote a little JS-Script wich alerts “Nope“ and the then redirects to pornhub.com after page load.

After about 2 WEEKS of funny redirecting, they updated their site and HTML-Code is now getting escaped.

undefined

im so evil

wk37
Favorite
Ranter
Comments
  • 4
    8y
    You should've gotten payment for that!
  • 3
    8y
    Btw...How did you find out that the guestbook didn't escape characters?
  • 0
    8y
    @samwir I tested it
  • 3
    8y
    I did basically the same with a teacher's site, but the difference is that nobody looks at it at all, Copyright is 2008-2009.
  • 2
    8y
    How did you get your script to run on their live server for every user who reaches the site?
  • 1
    8y
    Following
  • 5
    8y
    +1 for saying guestbook. Haven't heard that term since Geocities was the hot potato
  • 8
    8y
    @code The guestbook with my evil message is public. When anybody goes to the site, the message with the script is loaded and then, the script executes.
    Understand? 😕
  • 1
    8y
    @Skayo oh lol that's brilliant
    Not sure why but I imagined a wordpress blog kinda thing which was just created by site admin
  • 1
    8y
    @code it's called cross site scripting (XSS), in this case it's the stored XSS type. So that script is stored within the DB and as @Skayo explained, it loads whenever someone opens the site
Related Rants
devRant © 2021 Hexical Labs LLC
Privacy Policy  |  Terms of Service
Add Comment