Scornhub - 26 May 2016
The meaning of life tastes like chicken - 24 Feb 2016
fucking astrology man - 09 Dec 2015
Freelance Consulting - 23 Nov 2015
The Wassenaar Effect - 09 Jun 2015
Scantastic! - 11 Feb 2015
It's all fucked - 05 Jan 2015
The tortured poet - 28 Dec 2014
Gone in 660 Seconds - 25 Nov 2014
College Graduation - 20 Nov 2014
Yahoo for the craic! - 21 Sep 2014
IRC what you did there... - 02 Aug 2014
Let me Bug you!? - 19 Jun 2014
Plesk 10 & 11 SSO XXE/XSS - 09 May 2014
Final Year Woes - 24 Apr 2014
SWMing in privilege, or drowning? - 10 Apr 2014
Lucid Surrealist Dreams and techno-lust. - 23 Mar 2014
New Raspberry piToy - 05 Feb 2014
Happy 2014! - 15 Jan 2014
Helpdesk Pilot Xss/CSRF Add an Admin - 30 Nov 2013
Squidoo.com $1,100 bug bounty - 02 Nov 2013
Yahoo Xss bug bounty - 01 Oct 2013
Moodle 2.0 Account Takeover - 04 Sep 2013
Xss Challenge Accepted - 17 Aug 2013
rpliy - rpi python web player - 25 Jul 2013
Busy times - 10 Jul 2013
Source Conference - 27 May 2013
Coinbase.com bug bounty - 04 May 2013
Xssive, Moodle and CSRF - 11 Apr 2013

Yahoo Pipes is Great! - 05 Mar 2013
Science Hack-day Dublin - 03 Mar 2013
Simple port scan - 26 Feb 2013
4chan-tool.py - 19 Feb 2013
Wix.com Xss - 11 Feb 2013
Crawl.py Url Crawling - 09 Feb 2013
Xssive Demo tool - 12 Jan 2013
Cyberbullying? - 27 Dec 2012
Merry XssMas - 24 Dec 2012
Watching BBC Streams - 10 Dec 2012
SWF Disassembly - 26 Nov 2012
C <3 - 16 Nov 2012
Greasemonkey XSS 2 - 21 Oct 2012
Work Logging App - 20 Oct 2012
Greasemonkey XSS - 30 Sep 2012
Guestbook XSS - 18 Sep 2012
OWASP Vicnum Project - 05 Sep 2012
August... - 05 Sep 2012
XSS Scenarios. - 30 Jul 2012
Imageroll - 06 Jul 2012
The Dangers of XSS - 14 Jun 2012

US Threat Gauge - 30 May 2012
Is this art? - 28 May 2012
Rss2Irc - 25 May 2012
Blackboard Xss Jungle - 14 May 2012
Url Info Scraper - 10 May 2012
pythonchallenge.com - 27 Apr 2012
Prime Generator - 15 Apr 2012
Sockso 1.51 Xss - 07 Apr 2012


Ubuntu 10.10 Hardening - 18 Mar 2012
2nd Year Revisited - 17 Mar 2012

Greasemonkey XSS

Hai thar. I Have had a pretty great weekend taking part in the It was very enjoyable and I feel we did quite well for such a small team of 4. Most of the time there was only 2 or 3 of us. Here is how we got on...




We (team404 again) were using a very nice free online project management website and were collaborating on many of the challenges. I feel the difficulty level was excellently set, giving room for people of all skill level. We finished 160th with a score of 3600. Not too bad out of 639 teams considering we weren't solely focusing on the competition and were only together online for a couple of hours over the course of the weekend. This was the qualifying round for the Defcon ctf.

I wrote a very simple Greasemonkey script a while ago that I thought I'd share. It didn't really turn out useful in the competition in the end, but I may have accidentally broke the project collaboration site...




Here is maKs_XSS_Script.user.js

Basically as you can see, all it does is insert XSS vectors into any input text box when you double click on it, I use it only because it's faster than copy and pasting or writing them out every time. I'm sure you understand how to modify this to your needs :)




One of them worked to my surprise on wedoist.com resulting in the javascript being executed when you scroll over a link in the chat box. I have reported it and it is fixed. I also learned the downside to this script today as I never turned it off and accidentally submitted a vector into a college form that was submitted. *FAIL*

I will most definitely be entering as many ctfs as I can in the future as I learned some very interesting new things and got to slightly sharpen my already learned skills with many other tools/things I don't get to use often! That's all for now!

HAX BRAH