DO NOT USE alert(1) for XSS

Поделиться
HTML-код
  • Опубликовано: 26 ноя 2024

Комментарии • 252

  • @nk2ishere
    @nk2ishere 3 года назад +569

    It would have been funny for google to really alert 1 when you input alert(1) into search box

    • @ThomasOrlita
      @ThomasOrlita 3 года назад +38

      I think they did something like that once on the Bughunter page.

    • @2das
      @2das 3 года назад +109

      Oh no, hell no, it would not. Imagine all the amateur bug hunters who then spam their reports to the google bug bounty XD

    • @wrng-i9f
      @wrng-i9f 3 года назад +8

      @FBI Federal Bureau of Investigation Then they would pretty much ignore every XSS reports, sorry FBI.

    • @2das
      @2das 3 года назад +1

      @LastName Almaember you better ignore my browsing history

    • @1e1001
      @1e1001 3 года назад

      @@wrng-i9f well they can state that you have to use alert(document.domain) and just ignore all alert(1) ones or whatever

  • @mattp12
    @mattp12 3 года назад +747

    ok fine I’ll use alert(2)

  • @whydoineedausername1386
    @whydoineedausername1386 3 года назад +356

    "Look into the chrome developer tools" *Opens firefox*

    • @dertythegrower
      @dertythegrower 3 года назад +13

      Yeah.. it calling home every time I open the browser..
      yeah, no go for me. Also lack of script-viewing tools on chrome compared to firefox... mm, minimal.

    • @nicoper
      @nicoper 3 года назад +14

      Since this video is seemingly paid for by google, it's not strange that it contains some advertisement for Chrome.

    • @vaisakh_km
      @vaisakh_km 3 года назад +22

      "In a browser, the chrome is any visible aspect of a browser aside from the webpages themselves (e.g., toolbars, menu bar, tabs)."
      - so technically dev tools is a chrome
      (Not google chrome , it's just a name of a browser which they stollen)

    • @sebastianelytron8450
      @sebastianelytron8450 3 года назад +1

      @@vaisakh_km ^^ Can somebody verify that? I've literally never heard it before and information online on it is scarce. Is this really a technical term?

    • @vaisakh_km
      @vaisakh_km 3 года назад +2

      @@sebastianelytron8450 I also came to know about this from one of his own videos...."sandbox escape in Firefox" or something like that.....
      Checkout that video

  • @charlesfries
    @charlesfries 3 года назад +184

    This channel has taught me so much

    • @DawnnDusk-k4n
      @DawnnDusk-k4n 3 года назад +2

      This guy precisely

    • @tytangameplay3118
      @tytangameplay3118 3 года назад +3

      This channel got me a detention ;-;

    • @DeadDad1
      @DeadDad1 3 года назад

      Same! I absolutely love way he explains things!

    • @cedricvillani8502
      @cedricvillani8502 3 года назад

      You want his bounty all over your chin

    • @tytangameplay3118
      @tytangameplay3118 3 года назад +3

      @@LethalSwizzle found xss and other vulnerabilities in school website, and apparently I violated some policy

  • @4.0.4
    @4.0.4 3 года назад +54

    The reason we use alert is because of old browsers that didn't have such nice consoles. It was the easiest way to see something on screen. In fact I remember an old Microsoft site where I got a debug alert when I pressed some combination of buttons (by chance).

  • @TheMAZZTer
    @TheMAZZTer 3 года назад +178

    Funny thing is you're using a browser that shows the origin in the alert box regardless of message, so alert(1) is fine in those browsers.
    Though you do show the edge case where there is no origin (eg it's blank) the alert box title is different, so it's worth keeping that edge case in mind.

    • @dasten123
      @dasten123 3 года назад +9

      I though so too, but look at this case 7:30 it just says "An embedded page on this page says"

    • @_DeProgrammer
      @_DeProgrammer 3 года назад +8

      The browser may show the origin in the alert but I think you're missing the point. It's not a bug. Using alert(1) would render a false positive and it would be better to use something other than alert(1) that shows an actual xss on the origin.

  • @kissinger2867
    @kissinger2867 3 года назад +2

    The more I watch you the more I find something new, interesting and worth my time. Thank you very much.

  • @hikari_no_yume
    @hikari_no_yume 3 года назад +99

    Why is there an “advertisement” mark at the top-right, and a mention of sponsorship by Google in the subtitles, but not in the video itself?

    • @jaralara6429
      @jaralara6429 3 года назад +91

      Maybe this whole video is an ad from Google telling us to stop with the alert(1) reports 😂😂😂

    • @uttiya10
      @uttiya10 3 года назад +7

      I guess the “paid promotion” message at the beginning might be enough?

    • @violetwtf
      @violetwtf 3 года назад +2

      yeah this seems so sketchy

    • @luphoria
      @luphoria 3 года назад +8

      @@violetwtf not really.. the video is an ad

    • @unicodefox
      @unicodefox 3 года назад +3

      I think it was originally going to be that, then at the last moment he edited it out. The video is also low quality, almost as if he quickly downloaded it, edited and reuploaded

  • @IsAMank
    @IsAMank 3 года назад +27

    Huh, never considered the bug bounty angle. From my experience with clients, issues in the components of a client's application were still very valid, and would often prompt further discussion and remediation across org boundaries, which I see as the ideal outcome. Good practice for XSS checks nonetheless, great video!

  • @GiveAcademy
    @GiveAcademy 3 года назад +10

    in the past, my reason for using alert was because it took the least amount of characters, where many forms that were being tested had character limits. also most things would check for eval specifically, however alert was often forgotten... hehe

  • @user-ko7oo2qg1g
    @user-ko7oo2qg1g 3 года назад +6

    One of those rare videos by you about which I can say that I knew most of the things you mentioned. But still, a great one as always! 👍

  • @thapr0digy
    @thapr0digy 3 года назад +60

    When you said Google at 6:37, you triggered my Google assistant. Too bad it interrupts the video otherwise you could open malicious web sites on the users behalf

    • @yashrathi6862
      @yashrathi6862 3 года назад +2

      Actually might, be a nice idea lol, but don't you have your voice recognition setup?

  • @OdinRu1es
    @OdinRu1es 3 года назад +19

    Don’t use for security reasons.
    Uses for security reasons.

    • @jackharbor3347
      @jackharbor3347 3 года назад +2

      Why we shouldn't use for security reasons?

    • @JustPlayerDE
      @JustPlayerDE 3 года назад +7

      @@jackharbor3347 back in the past s where bad, now they are good i guess

  • @JPlexer
    @JPlexer 3 года назад +34

    How do some people say "Good Video" or "Amazing Explanation"? The Video literally just released

    • @reastle1307
      @reastle1307 3 года назад +7

      they fake it

    • @byekou
      @byekou 3 года назад +5

      gotta earn the likes

    • @LiveOverflow
      @LiveOverflow  3 года назад +86

      it's always true for my videos 🙃

    • @GamingBlake2002
      @GamingBlake2002 3 года назад

      *cough cough* cyberchiranjit *cough cough*

    • @JPlexer
      @JPlexer 3 года назад +5

      @@LiveOverflow well yes, but actually yes

  • @mekb-the
    @mekb-the 3 года назад +43

    seems you accidentally left advertisements watermark in the top right corner for the video lol

    • @gurglemurgle5
      @gurglemurgle5 3 года назад +9

      The vid might be sponsored by Google

    • @Test123747
      @Test123747 3 года назад +21

      saw a few german youtuber doing this for legal reasons.
      Otherwise competitors will assume you are breaking a law if some products are highlighted in the videos, even if there is no sponsorship. They will ask for money and for you to stop doing this in the feature (with some legal document ).
      In return those youtuber then have to explain that there is no sponsorship and might even need the assistance of a lawyer. If it was sponsored he probably has to pay money to the competitor.
      So they just place a advertisement note on every single video to just not having to deal with that kind of bullshit.

    • @bernhardschmidt9844
      @bernhardschmidt9844 3 года назад +9

      I mean, he does link to Googles new bug hunter University thing in the description and he does talk about how to do stuff in regards to google products throughout the video, so it being sponsored in some way isn't too far fetched.
      That said, it's weird he doesn't explicitly mention it anywhere...

    • @lilyliao9521
      @lilyliao9521 3 года назад

      @@Test123747 interesting

  • @thomascodes
    @thomascodes 3 года назад +2

    Different WAF'S Have diffrent responses to payloads some times destructuring the payload may work
    throw[onerror]=[alert],1

  • @menkiguo7805
    @menkiguo7805 3 года назад +7

    I was working for a website and their filter of XSS has alert(1) in it

  • @zaphooxx8779
    @zaphooxx8779 3 года назад +4

    Very good , valuable and helpful information you are providing here. Thanks !

  • @marcoschincaglia
    @marcoschincaglia 3 года назад +5

    ok, I had to interrupt my lazy Saturday afternoon to actually learn something useful

  • @arivanhouten6343
    @arivanhouten6343 3 года назад +6

    Finally another masterpiece!

  • @devprogramming
    @devprogramming 2 года назад +1

    Use print() instead of alert() because browsers are disabling the alert() for cross-domain s.

  • @1Hippo
    @1Hippo 3 года назад +26

    Chrome and Firefox both always display the origin domain in the alert, shown in the video for example at 3:41. I don't see the point of writing such a unnecessarily long payload, the video title seems a bit much clickbait, otherwise good explanation tho. alert(1) is still fine.
    btw: Opera and Vivaldi do it too, I guess all chromium based browsers.

    • @SolomonUcko
      @SolomonUcko 3 года назад +3

      It looks like inside s, at least browsers just say "an embedded page" rather than the actual domain or origin of the .

    • @dasten123
      @dasten123 3 года назад +1

      See 7:30

    • @1Hippo
      @1Hippo 3 года назад +3

      @@SolomonUcko They report the actual domain if it is set, blogger uses an too, see 4:26.
      In his selfmade example src is just not set, so it falls back to the generic message.

    • @1Hippo
      @1Hippo 3 года назад

      @@dasten123 See 7:45, in any case you get basically the same info.

  • @sharemarket1971
    @sharemarket1971 3 года назад

    I'm new in bug hunting...
    I understand nothing but I watched this video

  • @realjameskii
    @realjameskii 3 года назад +3

    Ok thanks, ill use alert(2) instead

  • @elessandro39
    @elessandro39 3 года назад

    Your channel is pure gold. Thank you

  • @h4ckv157
    @h4ckv157 3 года назад

    All your videos are my favorite. 💎 I really appreciate this one too 🙏

  • @TheJDebski
    @TheJDebski 3 года назад +2

    Thanks so much. You're doing great work. I would love more hunting videos. Very interesting

  • @paprika5487
    @paprika5487 3 года назад

    Thank you! This is good to bear in mind in future testing!

  • @scou1yy
    @scou1yy 3 года назад +2

    Imagine getting a pop-up saying "2", that would be threatening

  • @chiranjit9529
    @chiranjit9529 3 года назад +6

    Amazing explanation

    • @piyh3962
      @piyh3962 3 года назад +1

      This taught me more about XSS than any other video I've seen so far.

  • @Jimmy1985
    @Jimmy1985 3 года назад +2

    But can i still deploy malware on the client machine via this xss? A bEEF hook could hook into the browser of the client. I would not call any xss a safe xss but i guess it is out of scope.

  • @michaeldouglas1052
    @michaeldouglas1052 2 года назад

    Very precious and important tips, thank you!

  • @MrItrollaround
    @MrItrollaround 3 года назад +3

    Wait, so I'm not allowed to name my Skyrim player this anymore? Darn.

  • @HacknMate
    @HacknMate 3 года назад +2

    For Pentesting you use alert(1) because you need to document everything that is vulnerable on a blackbox webapp. For bug bounty, however this will not work because of 'impact'.

    • @coldplay5467
      @coldplay5467 3 года назад +1

      Not unless the organization’s webapp you’re pentesting is purposely allowing scripts to be executed by the end-users.

    • @HacknMate
      @HacknMate 3 года назад

      @@coldplay5467 that would be an isolated case. I'm talking in general.

  • @dasten123
    @dasten123 3 года назад +1

    This is interesting! Cool video man!

  • @aldison5070
    @aldison5070 3 года назад +4

    We use eval()

  • @4ag2
    @4ag2 3 года назад +1

    Very well explained! Thanks 👍

  • @10oneluv10
    @10oneluv10 2 года назад

    GREAT VIDEO! I never knew any of this.

  • @seclilc
    @seclilc 3 года назад +1

    Great video as always

  • @Hackerone1444
    @Hackerone1444 Год назад +1

    print(5)

  • @soonpeace9938
    @soonpeace9938 3 года назад

    Very Informative.............Keep it up

  • @asdfghyter
    @asdfghyter 3 года назад +1

    Is there any practical difference between document.domain and window.origin for these purposes?

  • @soroushhd2408
    @soroushhd2408 3 года назад +2

    man I believe in it I got a xss from an imortant web site thats belong to a very important organization that was pentested for 3 times 🤣🤣🤣

  • @mekb-the
    @mekb-the 3 года назад

    dark mode intro pog

  • @gradientO
    @gradientO 3 года назад +3

    alert(1)

  • @krlst.5977
    @krlst.5977 3 года назад

    That was great, very interesting video. Thank you

  • @Baeyk
    @Baeyk 2 года назад

    I love this guy

  • @sql7002
    @sql7002 3 года назад +1

    As usual 🔥🔥🔥🔥👌

  • @Lantalia
    @Lantalia 3 года назад +2

    We use alert because it predates chrome, firebug, and most useful 'consoles'

  • @hawk__
    @hawk__ 3 года назад

    Very Beautiful Explanation :)

  • @Seedhi-Baat
    @Seedhi-Baat 3 года назад

    Very nice observation! keep it up!

  • @drahoxx3076
    @drahoxx3076 3 года назад +2

    Why is there an "advertisement" message in the top right corner ? Is it just a mistake ?
    Anyway, very instructive video ! (Like the others!)

    • @tercmd
      @tercmd Год назад

      It's because Google paid him to produce this for Bug Hunter University and he thought it to be a good video, so he published here.

  • @b391i
    @b391i 3 года назад

    alert("You Are The Best")

  • @anthonation
    @anthonation 3 года назад +1

    Thank you so much 🙌🏻

  • @dclxviclan
    @dclxviclan 2 года назад

    Cool, nice tut

  • @pixelorange9651
    @pixelorange9651 3 года назад +1

    Thank you for your suggestions on XSS! Your video is very good, so I want to translate it and share it on the Chinese video website (bilibili) in my free time. I will keep the introduction and title of your video consistent and declare the author, and I will not get any profit from it. Do you agree with this matter?

  • @HackoMedia404
    @HackoMedia404 2 года назад

    Very informative video

  • @fairchild9able
    @fairchild9able 3 года назад

    Really nice clip. Thank you

  • @mindreader3947
    @mindreader3947 3 года назад

    wonderful video Thanks @liveoverflow

  • @156785543
    @156785543 3 года назад

    Excuse me my ignorance. What is the most dangerous thing you can do with that kind of attack? (xss) in Real life. I mean if I found a xss vuln the hacker just could catch my token/credentials by fishing? Or there is a other most power full attack. Excelente video and cheers from Argentina!

  • @muha0644
    @muha0644 3 года назад

    You make your videos really well. Amazing script, you speak clearly and enthusiastically, and you make cool graphics that are easy to understand and look nice in general, etc...
    The only thing I can complain about is that your IRL background looks kinda scary, like you are about to make an apology video or a documentary. It's not really a complaint but I though you could use the feedback. If you still have the breadboard pc you could make a counter and hang it in the background...or add some shelves or something.
    Unless you like the empty backdrop in which case ignore what I just said. Keep up the good work!

  • @charlie5tanley
    @charlie5tanley 2 года назад

    thank you thank you....

  • @arenaesports2580
    @arenaesports2580 3 года назад +1

    For Chrome we can use print now

  • @randomguy3784
    @randomguy3784 3 года назад

    Superb video👌

  • @spv420
    @spv420 3 года назад

    I just realized I wasn’t subscribed. I fixed that.

  • @danhorus
    @danhorus 3 года назад +1

    I use console.log or console.trace :)

  • @ZelenoJabko
    @ZelenoJabko 3 года назад +1

    Not all browsers support sandboxed s. Those browsers are vulnerable.

    • @ThePizzabrothersGaming
      @ThePizzabrothersGaming 3 года назад +1

      which one doesn't, internet explorer? thats EoL

    • @ZelenoJabko
      @ZelenoJabko 3 года назад +1

      @@ThePizzabrothersGaming your mom doesn't

  • @mualifulmizan9066
    @mualifulmizan9066 3 года назад +1

    Nice this video

  • @velho6298
    @velho6298 3 года назад

    Advertisement, nice touch.

  • @medpro5612
    @medpro5612 3 года назад +2

    Can I use alert(1337) ?

  • @DiThi
    @DiThi 3 года назад

    Are web workers another way of sandboxing potentially unsafe code?

  • @ceilidhDwy
    @ceilidhDwy 3 года назад +1

    Why is it marked as a sponsored video? Did google sponsor this one?

    • @tercmd
      @tercmd Год назад

      They paid for it to be created and he thought it to be a good video, so he published it on LiveOverflow

  • @ThePowerRanger
    @ThePowerRanger 3 года назад

    Very interesting.

  • @starkline3962
    @starkline3962 3 года назад

    which video editing tool you use to edit video

  • @thesheep6248
    @thesheep6248 3 года назад

    great info

  • @rafaeldacosta8581
    @rafaeldacosta8581 2 года назад +1

    destroying kids dreams under 12 minutes huahuahuahuahuahua

  • @w3w3w3
    @w3w3w3 3 года назад +1

    damm super interesting :)

  • @omri9325
    @omri9325 3 года назад

    Is this a new video-file format? the quality looks too compressed :|

  • @Jason-uv5tm
    @Jason-uv5tm 3 года назад

    very cool

  • @thejswaroop5230
    @thejswaroop5230 3 года назад

    Bro i have a suggestion....
    can u please put a video on PEGASUS spyware...like I'm genuinely confused what is it and why news channels are milking it so much....is it a thing to be afraid of?
    I would love to see your perspective on this....
    If not here maybe atleast in your other channel liveunderflow pls....?

  • @AntiWanted
    @AntiWanted 3 года назад

    Nice 👍

  • @neilthomas5026
    @neilthomas5026 3 года назад

    Gold

  • @shaswatmjha
    @shaswatmjha 2 года назад

    Is it self or reflected XSS if I modify the response in BURP and it shows alert, but doesnt show in URL?

  • @ThatGuy-bx3pv
    @ThatGuy-bx3pv 3 года назад

    RUclips recommend me this and I don't understand a thing. Why youtube? Why?

  • @mrspy8972
    @mrspy8972 3 года назад

    Make a video on Pegasus Too..

  • @KickoffCentral24
    @KickoffCentral24 3 года назад

    I need help in APDU setup

  • @LenaMilize
    @LenaMilize 3 года назад

    Ahh that's great

  • @lbproductions6215
    @lbproductions6215 3 года назад

    Interesting

  • @IudiciumInfernalum
    @IudiciumInfernalum 3 года назад

    I generally just `alert(%27MyHandle%27)`

  • @isvladxxe
    @isvladxxe 3 года назад

    is this a recipe how to make user js safe?

  • @yuck871
    @yuck871 3 года назад

    nice

  • @iooosef6006
    @iooosef6006 3 года назад

    Good thing I use alert(2)

  • @Epinardscaramel
    @Epinardscaramel 3 года назад

    5:02 Sorry Flash, f.

  • @b33bo93
    @b33bo93 3 года назад

    Why doesn't html just ignore scripts from the body?

    • @lmaoroflcopter
      @lmaoroflcopter 3 года назад

      📎 Hi it looks like you're trying to use a CSP?

  • @TianyuQi
    @TianyuQi 3 года назад

    me, who uses alert(): intensive sweating

  • @lmaoroflcopter
    @lmaoroflcopter 3 года назад

    Use prompt(2) ?? :D

  • @prawnstarrr
    @prawnstarrr 3 года назад

    alert("xss") -- a classic

  • @Quget
    @Quget 3 года назад +3

    4:22
    But you are using the much better browser.... Firefox!

  • @Agilato
    @Agilato 3 года назад

    Please, work on you over all sound volume, each time i watch your channel have to wear a headset cus volume is too low compare to other channels. Thanks for your work!

  • @bibelwalker
    @bibelwalker 3 года назад

    Michael Cera's cooler, more extraverted brother