Testing some other tags I made myself:
[button]type='button' value="Click me!" onclick="alert('Hi!');"[/button]
Last edited by Hardmath123 (2012-01-01 05:52:50)
Offline
And the code...
// ==UserScript== // @name Bookmarklet // @namespace Bookmarklet // @description Creates bookmarklets // @include http://* // ==/UserScript== document.body.innerHTML=document.body.innerHTML.replace(/\[button\]/g, "<input type='button' ").replace(/\[\/button\]/g, "/>");
Offline
Hardmath123 wrote:
And the code...
Code:
// ==UserScript== // @name Bookmarklet // @namespace Bookmarklet // @description Creates bookmarklets // @include http://* // ==/UserScript== document.body.innerHTML=document.body.innerHTML.replace(/\[button\]/g, "<input type='button' ").replace(/\[\/button\]/g, "/>");
How do I add this?!
Offline
[youtube]CAx6Mhc-0j4[/youtube]
That's pretty cool.
Offline
Servine wrote:
Hardmath123 wrote:
And the code...
Code:
// ==UserScript== // @name Bookmarklet // @namespace Bookmarklet // @description Creates bookmarklets // @include http://* // ==/UserScript== document.body.innerHTML=document.body.innerHTML.replace(/\[button\]/g, "<input type='button' ").replace(/\[\/button\]/g, "/>");How do I add this?!
paste the code into a .js file then drag it into chrome
Offline
[img]http://info.scratch.mit.edu/sites/infoscratch.media.mit.edu/files/image/example-Xmas-logo.jpg" onload="alert('This isnt secure!!\nI have your cookie:\n' + document.cookie);" /><img src="[/img]
http://en.wikipedia.org/wiki/Cross-site_scripting
Last edited by ZeroLuck (2012-01-01 07:59:52)
Offline
yay my code works
// ==UserScript== // @name iframe for scratch fora // @namespace iframe // @description displays iframes on the scratch fora // @include http://scratch.mit.edu/forums/viewtopic.php* // ==/UserScript== document.body.innerHTML=document.body.innerHTML.replace(/\[iframe\]/g, '<iframe src="').replace(/\[\/iframe\]/g, '" width="500" height="500" scrolling="auto" ></iframe>');
[iframe]http://dl.dropbox.com/u/37687009/Green-ishness%20Blue%20Chrome%20Theme/download.html[/iframe]
Offline
you can actually steal passwords with something like this^^
disabled the script
EDIT: we should also do something about auto-playing scratch projects
Last edited by roijac (2012-01-01 08:05:08)
Offline
roijac wrote:
you can actually steal passwords with something like this^^
disabled the script
Yes you can!
And much more too (the script can also post something in the Scratch forum)!
Offline
how do I add this code to chrome...
// ==UserScript==
// @name Bookmarklet
// @namespace Bookmarklet
// @description Creates bookmarklets
// @include http://*
// ==/UserScript==
document.body.innerHTML=document.body.innerHTML.replace(/\[button\]/g, "<input type='button' ").replace(/\[\/button\]/g, "/>");
And I got a warning about cookies when I visted this page!
Offline
Servine wrote:
Anyone else got this...
http://dl.dropbox.com/u/41073707/Capture.PNG
Yes. That is my XSS script.
I made it to show everybody that this "Adding the images back in to your scratch forum"
is very very dangerous: Somebody can get your Scratch account and write things in
the Scratch forum and much more!
You should disable the script!
Offline
ZeroLuck wrote:
Servine wrote:
Anyone else got this...
http://dl.dropbox.com/u/41073707/Capture.PNG
Yes. That is my XSS script.
I made it to show everybody that this "Adding the images back in to your scratch forum"
is very very dangerous: Somebody can get your Scratch account and write things in
the Scratch forum and much more!
You should disable the script!
Oh. But how else can we see images?
Offline
Servine wrote:
ZeroLuck wrote:
Servine wrote:
Anyone else got this...
http://dl.dropbox.com/u/41073707/Capture.PNG
Yes. That is my XSS script.
I made it to show everybody that this "Adding the images back in to your scratch forum"
is very very dangerous: Somebody can get your Scratch account and write things in
the Scratch forum and much more!
You should disable the script!Oh. But how else can we see images?
lol
Offline
ZeroLuck wrote:
Servine wrote:
ZeroLuck wrote:
Yes. That is my XSS script.
I made it to show everybody that this "Adding the images back in to your scratch forum"
is very very dangerous: Somebody can get your Scratch account and write things in
the Scratch forum and much more!
You should disable the script!Oh. But how else can we see images?
lol
I could make the script more secure, and make it check what you enter in the field, but I'm too lazy, maybe later.
Offline
rookwood101 wrote:
ZeroLuck wrote:
Servine wrote:
Oh. But how else can we see images?lol
I could make the script more secure, and make it check what you enter in the field, but I'm too lazy, maybe later.
Lol you are lazy when your script is very very dangerous?
Everybody can lost his account!
Offline
It is secure if you write the file yourself otherwise, you just have to trust that person.
Offline
Don't worry guys, I'm working on making it more secure, so it only accepts urls on the image tags, and only relevant stuff for the other things.
Offline
OMG! I just saw this!
THANK YOU SO MUCH!!!!!!!!!!!!:DDDDDD
*dies of happiness*
Wait why does it say that I should disable it? This pop-up from scratch.mit.edu says:
"rookwood's image support is not XSS format! It's better to disable it?
Awww...and I got all excited...
AND NOW IT SAYS "I HAVE YOUR COOKIE!"
Last edited by fungirl123 (2012-01-01 11:31:33)
Offline
fungirl123 wrote:
OMG! I just saw this!
THANK YOU SO MUCH!!!!!!!!!!!!:DDDDDD
*dies of happiness*
Wait why does it say that I should disable it? This pop-up from scratch.mit.edu says:
"rookwood's image support is not XSS format! It's better to disable it?
Awww...and I got all excited...
AND NOW IT SAYS "I HAVE YOUR COOKIE!"
Lol, that was me
You should disable it because everyone can get your account when you have this
not disabled!
Last edited by ZeroLuck (2012-01-01 11:36:57)
Offline
ZeroLuck wrote:
fungirl123 wrote:
OMG! I just saw this!
THANK YOU SO MUCH!!!!!!!!!!!!:DDDDDD
*dies of happiness*
Wait why does it say that I should disable it? This pop-up from scratch.mit.edu says:
"rookwood's image support is not XSS format! It's better to disable it?
Awww...and I got all excited...
AND NOW IT SAYS "I HAVE YOUR COOKIE!"Lol, that was me
You should disable it because everyone can get your account when you have this
not disabled!
I did
Are people going to get into my account now??!?!
I'm so noobish lol
Offline
fungirl123 wrote:
ZeroLuck wrote:
fungirl123 wrote:
OMG! I just saw this!
THANK YOU SO MUCH!!!!!!!!!!!!:DDDDDD
*dies of happiness*
Wait why does it say that I should disable it? This pop-up from scratch.mit.edu says:
"rookwood's image support is not XSS format! It's better to disable it?
Awww...and I got all excited...
AND NOW IT SAYS "I HAVE YOUR COOKIE!"Lol, that was me
You should disable it because everyone can get your account when you have this
not disabled!I did
Are people going to get into my account now??!?!
I'm so noobish lol
no don't worry, zeroluck hasn't actually done anything with the cookie, just displayed it.
Offline