Hi I've been playing around with XSS payloads. The code on the site I'm testing filters out <script></script>, but when I guessed, and used <<script>script><</script>/script> it works. This has exposed my misconceptions about how the filtering is done. Can someone...

er... i'm beginning to think i should have use a dictionary attack! jtr is taking ages to brute force it!

-- Tue Apr 07, 2015 12:19 am --

JtR cracked it in 13 seconds when I set the correct options.

Hey

I joined about a week ago, having loads of fun!

Before I joined, I knew next to nothing about hacking. I still know hardly anything, but what I know now is where and how to start learning.

Finally got the emails!

Took me ages, but I'm glad I didn't cheat

The key for me was realizing the importance of the criteria for merging two tables.