4 ms·

I don't run any JS. It's just an image:D

• jiggy2011 15y ago
  If the target site treats GET and POST identically then that could still be a problem. Just have <img src="http://targetsite.php/form?submit=1&data=gjoprgrger http://targetsite.php/form?submit=1&data=gjoprgrger />
• Roboprog 15y ago
  Have some more nightmare fuel: http://ha.ckers.org/xss.html http://ha.ckers.org/xss.html You can inject the things above into somebody else's data, or hide them in your own page from the beginning, I suppose. As a site developer, you can mitigate some mischief a bit by having any destructive update be a two step process: first get a form (or an "are you sure" page, if no real input is required), and add a nonce to the form, which is submitted back with the "request for destruction and subversion". Of course, the attacker can still request the form, harvest the nonce, and send it back with the attacking request, but now his attack has to be 2 steps instead of just 1. Also, if the nonce has a variable name, he has to know to grab everything off of the setup form, and not just resubmit a hard-coded name. Obviously, this won't stop everybody, but it does force them to try a little harder.
• kaonashi 15y ago
  The internet must be a very dark place for you.