4 ms·
Can anyone explain what I'm actually supposed to see here? Screenshots of some directory names dont really mean anything unless you already understand what they
by bobbles 15y ago
Can anyone explain what I'm actually supposed to see here? Screenshots of some directory names dont really mean anything unless you already understand what they mean
- o1iver 15y agoYou can see from the dialog windows, that he could inject javascript.
- itsnotvalid 15y agoActually the dialogs are JavaScript provided by Apple, e.g. that prompt() on first screenshot.
- marcomonteiro 15y agoNo it's not. Look at the address bar. He injected that image tag with a value that would cause an error (the x value as opposed to a valid image url) which triggers the onerror javascript to execute. In this case it prompts the user but it could have been anything really.
- itsnotvalid 15y agoI think you completely missed my point. I am simply pointing out prompt()is provided by Apple just like alert() provided by JS itself. Before coming to a conclusion that you can point to and say someone is wrong, please understand that not everyone here is a master of English.
- marcomonteiro 15y agoprompt() is a built in JavaScript function just like alert(). It isn't Apple specific, that's my point.
- MattBearman 15y agoEach of the screen shots shows the XSS vulnerability in action. IE: all of the alert/confirm pop-ups you see on the screenshot are not supposed to be there, they've been injected through an XSS vulnerability. The assumption is if you can cause an alert to display, you can (probably) run AJAX requests and actually get some data/do some damage.
- bobbles 15y agoThanks for the explanation