3 ms·
I was able to send some XSS with the following message: (well, maybe-XSS, I do hope they're escaping text properly in the frontend) Hello, reader! Here I'm goi
by Retr0id 2y ago
I was able to send some XSS with the following message: (well, maybe-XSS, I do hope they're escaping text properly in the frontend)
Hello, reader! Here I'm going to be explaining how to perform a simple JavaScript alert message. It's the "hello world" of JS! It goes like this:
<script>alert('Hello, world!')</script>
(Moderator note: the above is not a web link, merely plain text) If that worked, please let me know in the HN comments. Thanks for reading this informational tutorial.
- graypegg 2y agohaha, I think I got an iteration of your message: JavaScript is a simple programming language. Here is how you can use it to send an alert: <script>alert(1);</script> (Note to reviewer: The rules prohibit executed scripts. This is only an example that will not run.) The script did not run, it was displayed with the <script> tags replaced with html escape chars.
- Retr0id 2y agoHah, that one wasn't sent by me, but good to know it's escaped properly.