3 ms·

Advanced JavaScript Injections

55 points by known 8y ago

stevenmays 8y ago
Anyone else getting a 500 error on this?
- benve 8y ago
  The page does not open. At first I thought I had compromised the browser with a JavaScript exploits. curl -v https://brutelogic.com.br/blog/advanced-javascript-injections/ https://brutelogic.com.br/blog/advanced-javascript-injection... * Connection state changed (MAX_CONCURRENT_STREAMS updated)! < HTTP/2 503 < server: nginx < date: Thu, 13 Dec 2018 16:07:36 GMT < content-type: text/html; charset=iso-8859-1 < content-length: 323 < x-sucuri-id: 15005 < vary: Accept-Encoding < x-sucuri-cache: MISS < <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>503 Service Temporarily Unavailable</title> </head><body> <h1>Service Temporarily Unavailable</h1> <p>The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.</p> </body></html> * Connection #0 to host brutelogic.com.br left intact
- ntumlin 8y ago
  Here's a cached version from Google: https://webcache.googleusercontent.com/search?q=cache:BaMH6hpNFacJ:https://brutelogic.com.br/blog/advanced-javascript-injections/+&cd=1&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:BaMH6h... Unfortunately it looks like there's a playground for you to try exploiting these vulnerabilities yourself that isn't cached.
XCabbage 8y ago
People failing to load the page, note that http://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fbrutelogic.com.br%2Fblog%2Fadvanced-javascript-injections%2F&oq=cache%3Ahttps%3A%2F%2Fbrutelogic.com.br%2Fblog%2Fadvanced-javascript-injections%2F&aqs=chrome..69i57j69i58.909j0j7&sourceid=chrome&ie=UTF-8 http://webcache.googleusercontent.com/search?q=cache%3Ahttps... works.
tempodox 8y ago
What's the need for this new term? Up to now, the javascript injection orgies were just called web sites.
augbog 8y ago
ah the good ol reddi.. err HN hug of death
- reaperducer 8y ago
  It's been Slashdotted.
bwindels 8y ago
Not sure what PHP escape method is used in the example on the server, but shouldn't \" escape to \\\" instead of \\"?

55 points by known 8y ago

stevenmays 8y ago

Anyone else getting a 500 error on this?

benve 8y ago
The page does not open. At first I thought I had compromised the browser with a JavaScript exploits. curl -v https://brutelogic.com.br/blog/advanced-javascript-injections/ https://brutelogic.com.br/blog/advanced-javascript-injection... * Connection state changed (MAX_CONCURRENT_STREAMS updated)! < HTTP/2 503 < server: nginx < date: Thu, 13 Dec 2018 16:07:36 GMT < content-type: text/html; charset=iso-8859-1 < content-length: 323 < x-sucuri-id: 15005 < vary: Accept-Encoding < x-sucuri-cache: MISS < <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>503 Service Temporarily Unavailable</title> </head><body> <h1>Service Temporarily Unavailable</h1> <p>The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.</p> </body></html> * Connection #0 to host brutelogic.com.br left intact
ntumlin 8y ago
Here's a cached version from Google: https://webcache.googleusercontent.com/search?q=cache:BaMH6hpNFacJ:https://brutelogic.com.br/blog/advanced-javascript-injections/+&cd=1&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:BaMH6h... Unfortunately it looks like there's a playground for you to try exploiting these vulnerabilities yourself that isn't cached.

XCabbage 8y ago

People failing to load the page, note that http://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fbrutelogic.com.br%2Fblog%2Fadvanced-javascript-injections%2F&oq=cache%3Ahttps%3A%2F%2Fbrutelogic.com.br%2Fblog%2Fadvanced-javascript-injections%2F&aqs=chrome..69i57j69i58.909j0j7&sourceid=chrome&ie=UTF-8 http://webcache.googleusercontent.com/search?q=cache%3Ahttps... works.

tempodox 8y ago

What's the need for this new term? Up to now, the javascript injection orgies were just called web sites.

augbog 8y ago

ah the good ol reddi.. err HN hug of death

reaperducer 8y ago
It's been Slashdotted.

bwindels 8y ago

Not sure what PHP escape method is used in the example on the server, but shouldn't \" escape to \\\" instead of \\"?