DO NOT USE alert(1) for XSS

[@mattp12]

ok fine I’ll use alert(2)

[@user-zu6ts5fb6g]

based

[@magicmulder]

alert(0.5+0.5);

[@1Hippo]

alert(Math.PI)

[@FUTUREPES]

😂

[@goodrun88]

console.log(1-alert(1)) or eval(alert(1))

[@nk2ishere]

It would have been funny for google to really alert 1 when you input alert(1) into search box

[@ThomasOrlita]

I think they did something like that once on the Bughunter page.

[@2das]

Oh no, hell no, it would not. Imagine all the amateur bug hunters who then spam their reports to the google bug bounty XD

[@wrng-i9f]

@FBI Federal Bureau of Investigation Then they would pretty much ignore every XSS reports, sorry FBI.

[@2das]

@LastName Almaember you better ignore my browsing history

[@1e1001]

@@wrng-i9f well they can state that you have to use alert(document.domain) and just ignore all alert(1) ones or whatever

[@whydoineedausername1386]

"Look into the chrome developer tools" *Opens firefox*

[@dertythegrower]

Yeah.. it calling home every time I open the browser.. yeah, no go for me. Also lack of script-viewing tools on chrome compared to firefox... mm, minimal.

[@nicoper]

Since this video is seemingly paid for by google, it's not strange that it contains some advertisement for Chrome.

[@vaisakh_km]

"In a browser, the chrome is any visible aspect of a browser aside from the webpages themselves (e.g., toolbars, menu bar, tabs)." - so technically dev tools is a chrome (Not google chrome , it's just a name of a browser which they stollen)

[@sebastianelytron8450]

@@vaisakh_km ^^ Can somebody verify that? I've literally never heard it before and information online on it is scarce. Is this really a technical term?

[@vaisakh_km]

@@sebastianelytron8450 I also came to know about this from one of his own videos...."sandbox escape in Firefox" or something like that..... Checkout that video

[@charlesfries]

This channel has taught me so much

[@DawnnDusk-k4n]

This guy precisely

[@tytangameplay3118]

This channel got me a detention ;-;

[@DeadDad1]

Same! I absolutely love way he explains things!

[@cedricvillani8502]

You want his bounty all over your chin

[@tytangameplay3118]

@@LethalSwizzle found xss and other vulnerabilities in school website, and apparently I violated some policy

[@TheMAZZTer]

Funny thing is you're using a browser that shows the origin in the alert box regardless of message, so alert(1) is fine in those browsers. Though you do show the edge case where there is no origin (eg it's blank) the alert box title is different, so it's worth keeping that edge case in mind.

[@dasten123]

I though so too, but look at this case 7:30 it just says "An embedded page on this page says"

[@_DeProgrammer]

The browser may show the origin in the alert but I think you're missing the point. It's not a bug. Using alert(1) would render a false positive and it would be better to use something other than alert(1) that shows an actual xss on the origin.

[@4.0.4]

The reason we use alert is because of old browsers that didn't have such nice consoles. It was the easiest way to see something on screen. In fact I remember an old Microsoft site where I got a debug alert when I pressed some combination of buttons (by chance).

[@hikari_no_yume]

Why is there an “advertisement” mark at the top-right, and a mention of sponsorship by Google in the subtitles, but not in the video itself?

[@jaralara6429]

Maybe this whole video is an ad from Google telling us to stop with the alert(1) reports 😂😂😂

[@uttiya10]

I guess the “paid promotion” message at the beginning might be enough?

[@violetwtf]

yeah this seems so sketchy

[@luphoria]

@@violetwtf not really.. the video is an ad

[@unicodefox]

I think it was originally going to be that, then at the last moment he edited it out. The video is also low quality, almost as if he quickly downloaded it, edited and reuploaded

[@GiveAcademy]

in the past, my reason for using alert was because it took the least amount of characters, where many forms that were being tested had character limits. also most things would check for eval specifically, however alert was often forgotten... hehe

[@IsAMank]

Huh, never considered the bug bounty angle. From my experience with clients, issues in the components of a client's application were still very valid, and would often prompt further discussion and remediation across org boundaries, which I see as the ideal outcome. Good practice for XSS checks nonetheless, great video!

[@kissinger2867]

The more I watch you the more I find something new, interesting and worth my time. Thank you very much.

[@thapr0digy]

When you said Google at 6:37, you triggered my Google assistant. Too bad it interrupts the video otherwise you could open malicious web sites on the users behalf

[@yashrathi6862]

Actually might, be a nice idea lol, but don't you have your voice recognition setup?

[@user-ko7oo2qg1g]

One of those rare videos by you about which I can say that I knew most of the things you mentioned. But still, a great one as always! 👍

[@JPlexer]

How do some people say "Good Video" or "Amazing Explanation"? The Video literally just released

[@reastle1307]

they fake it

[@byekou]

gotta earn the likes

[@LiveOverflow]

it's always true for my videos 🙃

[@GamingBlake2002]

*cough cough* cyberchiranjit *cough cough*

[@JPlexer]

@@LiveOverflow well yes, but actually yes

[@OdinRu1es]

Don’t use for security reasons. Uses for security reasons.

[@jackharbor3347]

Why we shouldn't use for security reasons?

[@JustPlayerDE]

@@jackharbor3347 back in the past s where bad, now they are good i guess

[@1Hippo]

Chrome and Firefox both always display the origin domain in the alert, shown in the video for example at 3:41. I don't see the point of writing such a unnecessarily long payload, the video title seems a bit much clickbait, otherwise good explanation tho. alert(1) is still fine. btw: Opera and Vivaldi do it too, I guess all chromium based browsers.

[@SolomonUcko]

It looks like inside s, at least browsers just say "an embedded page" rather than the actual domain or origin of the .

[@dasten123]

See 7:30

[@1Hippo]

@@SolomonUcko They report the actual domain if it is set, blogger uses an too, see 4:26. In his selfmade example src is just not set, so it falls back to the generic message.

[@1Hippo]

@@dasten123 See 7:45, in any case you get basically the same info.

[@menkiguo7805]

I was working for a website and their filter of XSS has alert(1) in it

[@thomascodes]

Different WAF'S Have diffrent responses to payloads some times destructuring the payload may work throw[onerror]=[alert],1

[@mekb-the]

seems you accidentally left advertisements watermark in the top right corner for the video lol

[@gurglemurgle5]

The vid might be sponsored by Google

[@Test123747]

saw a few german youtuber doing this for legal reasons. Otherwise competitors will assume you are breaking a law if some products are highlighted in the videos, even if there is no sponsorship. They will ask for money and for you to stop doing this in the feature (with some legal document ). In return those youtuber then have to explain that there is no sponsorship and might even need the assistance of a lawyer. If it was sponsored he probably has to pay money to the competitor. So they just place a advertisement note on every single video to just not having to deal with that kind of bullshit.

[@bernhardschmidt9844]

I mean, he does link to Googles new bug hunter University thing in the description and he does talk about how to do stuff in regards to google products throughout the video, so it being sponsored in some way isn't too far fetched. That said, it's weird he doesn't explicitly mention it anywhere...

[@lilyliao9521]

@@Test123747 interesting

[@arivanhouten6343]

Finally another masterpiece!

[@zaphooxx8779]

Very good , valuable and helpful information you are providing here. Thanks !

[@devprogramming]

Use print() instead of alert() because browsers are disabling the alert() for cross-domain s.

[@Jimmy1985]

But can i still deploy malware on the client machine via this xss? A bEEF hook could hook into the browser of the client. I would not call any xss a safe xss but i guess it is out of scope.

[@chiranjit9529]

Amazing explanation

[@piyh3962]

This taught me more about XSS than any other video I've seen so far.

[@marcoschincaglia]

ok, I had to interrupt my lazy Saturday afternoon to actually learn something useful

[@scou1yy]

Imagine getting a pop-up saying "2", that would be threatening

[@elessandro39]

Your channel is pure gold. Thank you

[@asdfghyter]

Is there any practical difference between document.domain and window.origin for these purposes?

[@sharemarket1971]

I'm new in bug hunting... I understand nothing but I watched this video

[@paprika5487]

Thank you! This is good to bear in mind in future testing!

[@h4ckv157]

All your videos are my favorite. 💎 I really appreciate this one too 🙏

[@realjameskii]

Ok thanks, ill use alert(2) instead

[@4ag2]

Very well explained! Thanks 👍

[@TheJDebski]

Thanks so much. You're doing great work. I would love more hunting videos. Very interesting

[@michaeldouglas1052]

Very precious and important tips, thank you!

[@aldison5070]

We use eval()

[@seclilc]

Great video as always

[@dasten123]

This is interesting! Cool video man!

[@HacknMate]

For Pentesting you use alert(1) because you need to document everything that is vulnerable on a blackbox webapp. For bug bounty, however this will not work because of 'impact'.

[@coldplay5467]

Not unless the organization’s webapp you’re pentesting is purposely allowing scripts to be executed by the end-users.

[@HacknMate]

@@coldplay5467 that would be an isolated case. I'm talking in general.

[@soroushhd2408]

man I believe in it I got a xss from an imortant web site thats belong to a very important organization that was pentested for 3 times 🤣🤣🤣

[@156785543]

Excuse me my ignorance. What is the most dangerous thing you can do with that kind of attack? (xss) in Real life. I mean if I found a xss vuln the hacker just could catch my token/credentials by fishing? Or there is a other most power full attack. Excelente video and cheers from Argentina!

[@10oneluv10]

GREAT VIDEO! I never knew any of this.

[@soonpeace9938]

Very Informative.............Keep it up

[@sql7002]

As usual 🔥🔥🔥🔥👌

[@drahoxx3076]

Why is there an "advertisement" message in the top right corner ? Is it just a mistake ? Anyway, very instructive video ! (Like the others!)

[@tercmd]

It's because Google paid him to produce this for Bug Hunter University and he thought it to be a good video, so he published here.

[@medpro5612]

Can I use alert(1337) ?

[@rupesholee]

why not

[@DiThi]

Are web workers another way of sandboxing potentially unsafe code?

[@pixelorange9651]

Thank you for your suggestions on XSS! Your video is very good, so I want to translate it and share it on the Chinese video website (bilibili) in my free time. I will keep the introduction and title of your video consistent and declare the author, and I will not get any profit from it. Do you agree with this matter?

[@MrItrollaround]

Wait, so I'm not allowed to name my Skyrim player this anymore? Darn.

[@anthonation]

Thank you so much 🙌🏻

[@starkline3962]

which video editing tool you use to edit video

[@hawk__]

Very Beautiful Explanation :)

[@Seedhi-Baat]

Very nice observation! keep it up!

[@krlst.5977]

That was great, very interesting video. Thank you

[@Hackerone1444]

print(5)

[@omri9325]

Is this a new video-file format? the quality looks too compressed :|

[@shaswatmjha]

Is it self or reflected XSS if I modify the response in BURP and it shows alert, but doesnt show in URL?

[@LiveOverflow]

Neither ;) it’s nothing ;)

[@shaswatmjha]

@@LiveOverflow

[@ceilidhDwy]

Why is it marked as a sponsored video? Did google sponsor this one?

[@tercmd]

They paid for it to be created and he thought it to be a good video, so he published it on LiveOverflow

[@fairchild9able]

Really nice clip. Thank you

[@Lantalia]

We use alert because it predates chrome, firebug, and most useful 'consoles'

[@dclxviclan]

Cool, nice tut

[@HackoMedia404]

Very informative video

[@rafaeldacosta8581]

destroying kids dreams under 12 minutes huahuahuahuahuahua

[@mindreader3947]

wonderful video Thanks @liveoverflow

[@TianyuQi]

me, who uses alert(): intensive sweating

[@Baeyk]

I love this guy

[@arenaesports2580]

For Chrome we can use print now

[@danhorus]

I use console.log or console.trace :)

[@mekb-the]

dark mode intro pog

[@randomguy3784]

Superb video👌

[@thejswaroop5230]

Bro i have a suggestion.... can u please put a video on PEGASUS spyware...like I'm genuinely confused what is it and why news channels are milking it so much....is it a thing to be afraid of? I would love to see your perspective on this.... If not here maybe atleast in your other channel liveunderflow pls....?

[@KickoffCentral24]

I need help in APDU setup

[@ZelenoJabko]

Not all browsers support sandboxed s. Those browsers are vulnerable.

[@ThePizzabrothersGaming]

which one doesn't, internet explorer? thats EoL

[@ZelenoJabko]

@@ThePizzabrothersGaming your mom doesn't

[@muha0644]

You make your videos really well. Amazing script, you speak clearly and enthusiastically, and you make cool graphics that are easy to understand and look nice in general, etc... The only thing I can complain about is that your IRL background looks kinda scary, like you are about to make an apology video or a documentary. It's not really a complaint but I though you could use the feedback. If you still have the breadboard pc you could make a counter and hang it in the background...or add some shelves or something. Unless you like the empty backdrop in which case ignore what I just said. Keep up the good work!

[@isvladxxe]

is this a recipe how to make user js safe?

[@Epinardscaramel]

5:02 Sorry Flash, f.

[@b391i]

alert("You Are The Best")

[@gradientO]

alert(1)

[@spv420]

I just realized I wasn’t subscribed. I fixed that.

[@mualifulmizan9066]

Nice this video

[@Quget]

4:22 But you are using the much better browser.... Firefox!

[@lmaoroflcopter]

Use prompt(2) ?? :D

[@velho6298]

Advertisement, nice touch.

[@b33bo93]

Why doesn't html just ignore scripts from the body?

[@lmaoroflcopter]

📎 Hi it looks like you're trying to use a CSP?

[@charlie5tanley]

thank you thank you....

[@ThePowerRanger]

Very interesting.

[@thesheep6248]

great info

[@mrspy8972]

Make a video on Pegasus Too..

[@prawnstarrr]

alert("xss") -- a classic

[@AntiWanted]

Nice 👍

[@ThatGuy-bx3pv]

KZbin recommend me this and I don't understand a thing. Why youtube? Why?

[@w3w3w3]

damm super interesting :)

[@iooosef6006]

Good thing I use alert(2)

[@IudiciumInfernalum]

I generally just `alert(%27MyHandle%27)`

[@Jason-uv5tm]

very cool

[@Agilato]

Please, work on you over all sound volume, each time i watch your channel have to wear a headset cus volume is too low compare to other channels. Thanks for your work!

[@iicloudbob8793]

Please try reverse engineering Synapse X. It will be a challenge for you

[@bibelwalker]

Michael Cera's cooler, more extraverted brother

[@neilthomas5026]

Gold

[@me-ashacker233]

Sir plese re upload how real hacking viedo sir you removed that viedo

[@nameless_9504]

And one more I have a came across a xss. But they aren't storing any information about user in cookies or localstorage. They are using completely stateless JSON web tokens and refresh token. When we are in certain endpoint then it will assign a in cookie using JWT. Best example using ( KEYCLOAK ). So I hosted a FORM to prove a attack possible in the domain.