Thread: Google Fake XSS

Tweet

Supb Guys , Year ago i seeking Bugs in Google Applications. I found one bug which is already know to Google , in fact Google added this vulnerability to make fool (Newbies). After a long time waiting , i have deiced to release it !

Code:

Fake Vuln URL  : https://www.google.com/appserve/security-bugs/new?rl=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E

Google used common payload to make fool !

It was wired for me when i use alert(1) , it was popping 41 As show in the following image.



Fake Alert Generating JS Code

Code:

<script>
    (function(){
        var sel = document.getElementById('f-Category');
        var inp = document.getElementById('f-Category-Other');
        setInterval(function(){
            if(sel.value == "other" && sel.style.display != 'none'){
                inp.style.display = 'block';
                sel.style.display = 'none';
                inp.focus();
                inp.onblur = function(){
                    if (inp.value == '' && inp.style.display == 'block'){
                        sel.style.display = 'block';
                        inp.style.display = 'none';
                        sel.value = 'none';
                    }
                }
            }
         },100);
         eval(function(p,a,c,k,e,r){e=function(c){return c.toString(a)};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('5(4.3.6(/2\\([\'"]a[\'"]\\)/))2(\'c\');7 5(4.3.6(/2\\([0-9]/))2(b);7 5(4.3.6(/2\\(8.d/))2(\'q.0.0.1\');7 5(4.3.6(/2\\(8.f/))4.3=\'g://h.i/j/k-l-m-n-o/p.e\';',27,27,'||alert|href|location|if|match|else|document||xss|42|excesses|domain|aspx|cookie|http|allrecipes|com|Recipe|Beths|Spicy|Oatmeal|Raisin|Cookies|Detail|127'.split('|'),0,{})); 
    })();
  </script>

As you can see the eval function which is responsible for alerting 41 ... You can use anyother payload to alert different different output !

PS: I Don't know some one already known it ! Coz its my very old finding

Thanks
Sandeep Aka [S]