Advanced JavaScript Injections

XCabbage · on Dec 13, 2018

People failing to load the page, note that http://webcache.googleusercontent.com/search?q=cache%3Ahttps... works.

stevenmays · on Dec 13, 2018

Anyone else getting a 500 error on this?

benve · on Dec 13, 2018

The page does not open. At first I thought I had compromised the browser with a JavaScript exploits.

curl -v https://brutelogic.com.br/blog/advanced-javascript-injection...

* Connection state changed (MAX_CONCURRENT_STREAMS updated)! < HTTP/2 503 < server: nginx < date: Thu, 13 Dec 2018 16:07:36 GMT < content-type: text/html; charset=iso-8859-1 < content-length: 323 < x-sucuri-id: 15005 < vary: Accept-Encoding < x-sucuri-cache: MISS < <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>503 Service Temporarily Unavailable</title> </head><body> <h1>Service Temporarily Unavailable</h1> <p>The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.</p> </body></html> * Connection #0 to host brutelogic.com.br left intact

ntumlin · on Dec 13, 2018

Here's a cached version from Google: https://webcache.googleusercontent.com/search?q=cache:BaMH6h...

Unfortunately it looks like there's a playground for you to try exploiting these vulnerabilities yourself that isn't cached.

bwindels · on Dec 14, 2018

Not sure what PHP escape method is used in the example on the server, but shouldn't \" escape to \\\" instead of \\"?

augbog · on Dec 13, 2018

ah the good ol reddi.. err HN hug of death

reaperducer · on Dec 13, 2018

It's been Slashdotted.

tempodox · on Dec 13, 2018

What's the need for this new term? Up to now, the javascript injection orgies were just called web sites.