DO NOT USE alert(1) for XSS

[@mattp12]

ok fine I’ll use alert(2)

[@user-zu6ts5fb6g]

based

[@magicmulder]

alert(0.5+0.5);

[@1Hippo]

alert(Math.PI)

[@FUTUREPES]

😂

[@goodrun88]

console.log(1-alert(1)) or eval(alert(1))

[@nk2ishere]

It would have been funny for google to really alert 1 when you input alert(1) into search box

[@ThomasOrlita]

I think they did something like that once on the Bughunter page.

[@2das]

Oh no, hell no, it would not. Imagine all the amateur bug hunters who then spam their reports to the google bug bounty XD

[@castles990]

@FBI Federal Bureau of Investigation Then they would pretty much ignore every XSS reports, sorry FBI.

[@2das]

@LastName Almaember you better ignore my browsing history

[@1e1001]

@@castles990 well they can state that you have to use alert(document.domain) and just ignore all alert(1) ones or whatever

[@whydoineedausername1386]

"Look into the chrome developer tools" *Opens firefox*

[@dertythegrower]

Yeah.. it calling home every time I open the browser.. yeah, no go for me. Also lack of script-viewing tools on chrome compared to firefox... mm, minimal.

[@nicoper]

Since this video is seemingly paid for by google, it's not strange that it contains some advertisement for Chrome.

[@vaisakhkm783]

"In a browser, the chrome is any visible aspect of a browser aside from the webpages themselves (e.g., toolbars, menu bar, tabs)." - so technically dev tools is a chrome (Not google chrome , it's just a name of a browser which they stollen)

[@sebastianelytron8450]

@@vaisakhkm783 ^^ Can somebody verify that? I've literally never heard it before and information online on it is scarce. Is this really a technical term?

[@vaisakhkm783]

@@sebastianelytron8450 I also came to know about this from one of his own videos...."sandbox escape in Firefox" or something like that..... Checkout that video

[@TheMAZZTer]

Funny thing is you're using a browser that shows the origin in the alert box regardless of message, so alert(1) is fine in those browsers. Though you do show the edge case where there is no origin (eg it's blank) the alert box title is different, so it's worth keeping that edge case in mind.

[@dasten123]

I though so too, but look at this case 7:30 it just says "An embedded page on this page says"

[@_DeProgrammer]

The browser may show the origin in the alert but I think you're missing the point. It's not a bug. Using alert(1) would render a false positive and it would be better to use something other than alert(1) that shows an actual xss on the origin.

[@thapr0digy]

When you said Google at 6:37, you triggered my Google assistant. Too bad it interrupts the video otherwise you could open malicious web sites on the users behalf

[@yashrathi6862]

Actually might, be a nice idea lol, but don't you have your voice recognition setup?

[@mekb-the]

seems you accidentally left advertisements watermark in the top right corner for the video lol

[@gurglemurgle5]

The vid might be sponsored by Google

[@Test123747]

saw a few german youtuber doing this for legal reasons. Otherwise competitors will assume you are breaking a law if some products are highlighted in the videos, even if there is no sponsorship. They will ask for money and for you to stop doing this in the feature (with some legal document ). In return those youtuber then have to explain that there is no sponsorship and might even need the assistance of a lawyer. If it was sponsored he probably has to pay money to the competitor. So they just place a advertisement note on every single video to just not having to deal with that kind of bullshit.

[@bernhardschmidt9844]

I mean, he does link to Googles new bug hunter University thing in the description and he does talk about how to do stuff in regards to google products throughout the video, so it being sponsored in some way isn't too far fetched. That said, it's weird he doesn't explicitly mention it anywhere...

[@lilyliao9521]

@@Test123747 interesting

[@zaphooxx8779]

Very good , valuable and helpful information you are providing here. Thanks !

[@chiranjit9529]

Amazing explanation

[@piyh3962]

This taught me more about XSS than any other video I've seen so far.

[@michaeldouglas1052]

Very precious and important tips, thank you!

[@seclilc]

Great video as always

[@drahoxx3076]

Why is there an "advertisement" message in the top right corner ? Is it just a mistake ? Anyway, very instructive video ! (Like the others!)

[@tercmd]

It's because Google paid him to produce this for Bug Hunter University and he thought it to be a good video, so he published here.

[@soonpeace9938]

Very Informative.............Keep it up

[@velho6298]

Advertisement, nice touch.

[@danhorus]

I use console.log or console.trace :)

[@b391i]

alert("You Are The Best")

[@MrItrollaround]

Wait, so I'm not allowed to name my Skyrim player this anymore? Darn.

[@muha0644]

You make your videos really well. Amazing script, you speak clearly and enthusiastically, and you make cool graphics that are easy to understand and look nice in general, etc... The only thing I can complain about is that your IRL background looks kinda scary, like you are about to make an apology video or a documentary. It's not really a complaint but I though you could use the feedback. If you still have the breadboard pc you could make a counter and hang it in the background...or add some shelves or something. Unless you like the empty backdrop in which case ignore what I just said. Keep up the good work!

[@DiThi]

Are web workers another way of sandboxing potentially unsafe code?

[@ceilidhDwy]

Why is it marked as a sponsored video? Did google sponsor this one?

[@tercmd]

They paid for it to be created and he thought it to be a good video, so he published it on LiveOverflow

[@IudiciumInfernalum]

I generally just `alert(%27MyHandle%27)`

[@shaswat2]

Is it self or reflected XSS if I modify the response in BURP and it shows alert, but doesnt show in URL?

[@LiveOverflow]

Neither ;) it’s nothing ;)

[@shaswat2]

@@LiveOverflow

[@neilthomas5026]

Gold

[@lmaoroflcopter]

Use prompt(2) ?? :D

[@yuck871]

nice

[@iicloudbob8793]

Please try reverse engineering Synapse X. It will be a challenge for you

[@spongechair]

1

[@lior_haddad]

oh

[@bibelwalker]

Michael Cera's cooler, more extraverted brother

[@mwint1982]

Zeguridy izzu

[@nameless_9504]

And one more I have a came across a xss. But they aren't storing any information about user in cookies or localstorage. They are using completely stateless JSON web tokens and refresh token. When we are in certain endpoint then it will assign a in cookie using JWT. Best example using ( KEYCLOAK ). So I hosted a FORM to prove a attack possible in the domain.

[@me-ashacker233]

Sir plese re upload how real hacking viedo sir you removed that viedo

[@ripplerxeon]

I see Firefox ... Lol

[@Andre-xz5ky]

Can you crash the whole shitty internet please? If someone read this who can, just do it. Like nike is using childs for Manufacturing. Only do it.

[@hblaub]

You are an ALERT()ist!

[@theMoporter]

It's annoying as fuck as a user.

[@UlfKlose]

Is it just me or are you "unsharp" in almost every part of the video? Looks almost like you're out of focus most of the time.

[@hikari_no_yume]

Why is there an “advertisement” mark at the top-right, and a mention of sponsorship by Google in the subtitles, but not in the video itself?

[@jaralara6429]

Maybe this whole video is an ad from Google telling us to stop with the alert(1) reports 😂😂😂

[@uttiya10]

I guess the “paid promotion” message at the beginning might be enough?

[@violetwtf]

yeah this seems so sketchy

[@luphoria]

@@violetwtf not really.. the video is an ad

[@unicodefox]

I think it was originally going to be that, then at the last moment he edited it out. The video is also low quality, almost as if he quickly downloaded it, edited and reuploaded

[@charlesfries]

This channel has taught me so much

[@DawnnDusk-k4n]

This guy precisely

[@tytangameplay3118]

This channel got me a detention ;-;

[@DeadDad1]

Same! I absolutely love way he explains things!

[@cedricvillani8502]

You want his bounty all over your chin

[@tytangameplay3118]

@@LethalSwizzle found xss and other vulnerabilities in school website, and apparently I violated some policy

[@JPlexer]

How do some people say "Good Video" or "Amazing Explanation"? The Video literally just released

[@reastle1307]

they fake it

[@byekou]

gotta earn the likes

[@LiveOverflow]

it's always true for my videos 🙃

[@GamingBlake2002]

*cough cough* cyberchiranjit *cough cough*

[@JPlexer]

@@LiveOverflow well yes, but actually yes

[@OdinRu1es]

Don’t use for security reasons. Uses for security reasons.

[@jackharbor3347]

Why we shouldn't use for security reasons?

[@JustPlayerDE]

@@jackharbor3347 back in the past s where bad, now they are good i guess

[@IsAMank]

Huh, never considered the bug bounty angle. From my experience with clients, issues in the components of a client's application were still very valid, and would often prompt further discussion and remediation across org boundaries, which I see as the ideal outcome. Good practice for XSS checks nonetheless, great video!

[@menkiguo7805]

I was working for a website and their filter of XSS has alert(1) in it

[@4.0.4]

The reason we use alert is because of old browsers that didn't have such nice consoles. It was the easiest way to see something on screen. In fact I remember an old Microsoft site where I got a debug alert when I pressed some combination of buttons (by chance).

[@GiveAcademy]

in the past, my reason for using alert was because it took the least amount of characters, where many forms that were being tested had character limits. also most things would check for eval specifically, however alert was often forgotten... hehe

[@1Hippo]

Chrome and Firefox both always display the origin domain in the alert, shown in the video for example at 3:41. I don't see the point of writing such a unnecessarily long payload, the video title seems a bit much clickbait, otherwise good explanation tho. alert(1) is still fine. btw: Opera and Vivaldi do it too, I guess all chromium based browsers.

[@SolomonUcko]

It looks like inside s, at least browsers just say "an embedded page" rather than the actual domain or origin of the .

[@dasten123]

See 7:30

[@1Hippo]

@@SolomonUcko They report the actual domain if it is set, blogger uses an too, see 4:26. In his selfmade example src is just not set, so it falls back to the generic message.

[@1Hippo]

@@dasten123 See 7:45, in any case you get basically the same info.

[@Jimmy1985]

But can i still deploy malware on the client machine via this xss? A bEEF hook could hook into the browser of the client. I would not call any xss a safe xss but i guess it is out of scope.

[@realjameskii]

Ok thanks, ill use alert(2) instead

[@thomascodes]

Different WAF'S Have diffrent responses to payloads some times destructuring the payload may work throw[onerror]=[alert],1

[@soroushhd2408]

man I believe in it I got a xss from an imortant web site thats belong to a very important organization that was pentested for 3 times 🤣🤣🤣

[@user-ko7oo2qg1g]

One of those rare videos by you about which I can say that I knew most of the things you mentioned. But still, a great one as always! 👍

[@gradientO]

alert(1)

[@marcoschincaglia]

ok, I had to interrupt my lazy Saturday afternoon to actually learn something useful

[@rafaeldacosta8581]

destroying kids dreams under 12 minutes huahuahuahuahuahua

[@aldison5070]

We use eval()

[@medpro5612]

Can I use alert(1337) ?

[@rupesholee]

why not

[@scou1yy]

Imagine getting a pop-up saying "2", that would be threatening

[@Lantalia]

We use alert because it predates chrome, firebug, and most useful 'consoles'

[@arivanhouten6343]

Finally another masterpiece!

[@pixelorange9651]

Thank you for your suggestions on XSS! Your video is very good, so I want to translate it and share it on the Chinese video website (bilibili) in my free time. I will keep the introduction and title of your video consistent and declare the author, and I will not get any profit from it. Do you agree with this matter?

[@Hackerone1444]

print(5)

[@devprogramming]

Use print() instead of alert() because browsers are disabling the alert() for cross-domain s.

[@TheJDebski]

Thanks so much. You're doing great work. I would love more hunting videos. Very interesting

[@arenaesports2580]

For Chrome we can use print now

[@kissinger2867]

The more I watch you the more I find something new, interesting and worth my time. Thank you very much.

[@asdfghyter]

Is there any practical difference between document.domain and window.origin for these purposes?

[@w3w3w3]

damm super interesting :)

[@vinayjain322]

ok i will use alert('fucked')

[@thejswaroop5230]

Bro i have a suggestion.... can u please put a video on PEGASUS spyware...like I'm genuinely confused what is it and why news channels are milking it so much....is it a thing to be afraid of? I would love to see your perspective on this.... If not here maybe atleast in your other channel liveunderflow pls....?

[@2das]

gif mi bounti plis

[@techdevils1597]

alert("xss")

[@156785543]

Excuse me my ignorance. What is the most dangerous thing you can do with that kind of attack? (xss) in Real life. I mean if I found a xss vuln the hacker just could catch my token/credentials by fishing? Or there is a other most power full attack. Excelente video and cheers from Argentina!

[@anandakumar625xib8]

He looks like Mr beast

[@10oneluv10]

GREAT VIDEO! I never knew any of this.

[@ThatGuy-bx3pv]

KZbin recommend me this and I don't understand a thing. Why youtube? Why?

[@charlie5tanley]

thank you thank you....

[@Epinardscaramel]

5:02 Sorry Flash, f.

[@ZelenoJabko]

Not all browsers support sandboxed s. Those browsers are vulnerable.

[@ThePizzabrothersGaming]

which one doesn't, internet explorer? thats EoL

[@ZelenoJabko]

@@ThePizzabrothersGaming your mom doesn't

[@4ag2]

Very well explained! Thanks 👍

[@dclxviclan]

Cool, nice tut

[@mualifulmizan9066]

Nice this video

[@spv420]

I just realized I wasn’t subscribed. I fixed that.

[@dasten123]

This is interesting! Cool video man!

[@pedrophillipe]

se eu quiser uso sim, oxi kk

[@sourandbitter3062]

That was interesting, but he repeated himself a lot, the video could have been half the lenght.

[@omri9325]

Is this a new video-file format? the quality looks too compressed :|

[@Hackedpw]

Kiii

[@sharemarket1971]

I'm new in bug hunting... I understand nothing but I watched this video

[@Quget]

4:22 But you are using the much better browser.... Firefox!

[@anthonation]

Thank you so much 🙌🏻

[@sql7002]

As usual 🔥🔥🔥🔥👌

[@PotatoChips-jy9pk]

69

[@prawnstarrr]

alert("xss") -- a classic

[@savithnishitha5562]

.

[@iooosef6006]

Good thing I use alert(2)

[@rupesholee]

1337

[@KickoffCentral24]

I need help in APDU setup

[@TianyuQi]

me, who uses alert(): intensive sweating

[@mindreader3947]

wonderful video Thanks @liveoverflow

[@cocomelonboy1]

[@HackoMedia404]

Very informative video