XSS

[jadecook]

Alright, say for instance I am hacking a form. Not just any form, an email form! Fill out name, email, etc, and after pressing submit it says, "Thank you NAME!". So I think to myself, hmmm and type in "<b>NAME</b>" in the name field then press submit. Then it comes out "Thank you NAME!". So now I try "<script>alert("hello");</script>" in the name field and press submit but nothing shows up! I check the source and you can see in the source it says "<script>alert("hello");</script>".

Why is this?

[WallShadow]

Alright, say for instance I am hacking a form. Not just any form, an email form! Fill out name, email, etc, and after pressing submit it says, "Thank you NAME!". So I think to myself, hmmm and type in "<b>NAME</b>" in the name field then press submit. Then it comes out "Thank you NAME!". So now I try "<script>alert("hello");</script>" in the name field and press submit but nothing shows up! I check the source and you can see in the source it says "<script>alert("hello");</script>".

Why is this?

If the script is there, but not being activated, it's possible that some program on your computer detected the XSS and prevented it from executing. I know some browsers and browser-plugins do do that.

[0phidian]

Some sites allow a few tags like bold and italics but block others like script tags. In which case you would need to find a way around the filtering.

[weekend hacker]

^what they said
If its not escaping that part in the source then its probably your very own browser thats preventing it from being run(I for one use noscript, so most things are blocked unless if I give that site permission)
Also, if this is an email script, one other thing to look at besides XSS would be injecting newlines. Lookup how email headers look like, find out if perhaps you can alter them and maybe say.. send an email to 100 people instead of just 1.

[WallShadow]

Also, if this is an email script, one other thing to look at besides XSS would be injecting newlines. Lookup how email headers look like, find out if perhaps you can alter them and maybe say.. send an email to 100 people instead of just 1.