kubel
BANNED
- Oct 30, 2007
- 274
- 358
Hello,
This is my first post so please, don't be cruel
Here's a list of some .gov sites that I have found to be exploitable.
I have used a method described in an original version of the Project Black Mask, which, as far as I know, was never published.
The idea is that you will change the forms on these sites so that instead of
getting information, they will be posting it. You will place your link in the
search box, and after modifying the form, the link will get posted instead of
searched when you hit submit.
Here's what you have to do:
1. Get Firefox
2. Download webmaster toolbar from:
http://chrispederick.com/work/webdeveloper/
3. Use the Firefox Extension by going to "forms" and selecting convert
form methods, change from "post" to "get".
4. Place the link and anchor text you want to use in the search box and hit
submit. The link needs to be posted in the format below.
<a href="http://www.spam.com" title="anchor text" target="_blank">spam</a>
And here's a list of sites I have used to get the links back:
http://hxxp://www.ed.gov/help/site/advsearch/advSearch.jsp
http://hxxp://search.ocrwm.doe.gov/search/
http://hxxp://www.irs.gov/
http://hxxp://yosemite.epa.gov/oar/globalwarming.nsf/searchresult?OpenForm
http://hxxp://www.cancer.gov/clinicaltrials/search
http://hxxps://fortress.wa.gov/esd/worksource/Employment.aspx
http://hxxp://www.imls.gov/search.asp
http://hxxp://fwp.mt.gov/lands/search.aspx?q=ACT_4_0
http://hxxp://www.usmint.gov/search/index.cfm?flash=yes
http://hxxp://www.miamidade.gov/buildingcode/online_product_search.asp
http://hxxp://www.usa.gov/
http://hxxp://tax.idaho.gov/ucp_search_idaho.htm
http://hxxp://www.wsdot.wa.gov/communications/WebManual/Tools/Search.htm
http://hxxp://xxx.lanl.gov/form
http://hxxp://www.energystar.gov/index.cfm?fuseaction=dishwash.search_dishwashers
http://hxxp://www.courts.mo.gov/casenet/cases/searchCases.do?searchType=name
http://hxxp://www.nal.usda.gov/fnic/foodcomp/search/
http://hxxp://wireless2.fcc.gov/UlsApp/UlsSearch/searchAmateur.jsp
http://hxxp://www.gao.gov/docsearch/keyword.php
http://hxxp://www.ca5.uscourts.gov:8081/
hxxp://www.medicare.gov/NHCompare/Include/DataSection/Questions/SearchCriteria.asp?version=default&browser=IE|6|Win2000&language=English&defaultstatus=0&pagelist=Home
http://hxxp://scoweb.sco.ca.gov/UCP/
hxxp://www.ce9.uscourts.gov/web/newopinions.nsf/f606ac175e010d64882566eb00658118/$searchForm?SearchView
http://hxxp://www.nsf.gov/awardsearch/
http://hxxps://fortress.wa.gov/esd/worksource/AdvancedJobSearch.aspx
http://hxxp://wireless2.fcc.gov/UlsApp/UlsSearch/searchLicense.jsp
http://hxxp://www.yorkcounty.gov/search.htm
http://hxxps://nevadatreasurer.gov/ucsearch/
I hope it's going to work for you too.
Cheers,
kubel
This is my first post so please, don't be cruel
Here's a list of some .gov sites that I have found to be exploitable.
I have used a method described in an original version of the Project Black Mask, which, as far as I know, was never published.
The idea is that you will change the forms on these sites so that instead of
getting information, they will be posting it. You will place your link in the
search box, and after modifying the form, the link will get posted instead of
searched when you hit submit.
Here's what you have to do:
1. Get Firefox
2. Download webmaster toolbar from:
http://chrispederick.com/work/webdeveloper/
3. Use the Firefox Extension by going to "forms" and selecting convert
form methods, change from "post" to "get".
4. Place the link and anchor text you want to use in the search box and hit
submit. The link needs to be posted in the format below.
<a href="http://www.spam.com" title="anchor text" target="_blank">spam</a>
And here's a list of sites I have used to get the links back:
http://hxxp://www.ed.gov/help/site/advsearch/advSearch.jsp
http://hxxp://search.ocrwm.doe.gov/search/
http://hxxp://www.irs.gov/
http://hxxp://yosemite.epa.gov/oar/globalwarming.nsf/searchresult?OpenForm
http://hxxp://www.cancer.gov/clinicaltrials/search
http://hxxps://fortress.wa.gov/esd/worksource/Employment.aspx
http://hxxp://www.imls.gov/search.asp
http://hxxp://fwp.mt.gov/lands/search.aspx?q=ACT_4_0
http://hxxp://www.usmint.gov/search/index.cfm?flash=yes
http://hxxp://www.miamidade.gov/buildingcode/online_product_search.asp
http://hxxp://www.usa.gov/
http://hxxp://tax.idaho.gov/ucp_search_idaho.htm
http://hxxp://www.wsdot.wa.gov/communications/WebManual/Tools/Search.htm
http://hxxp://xxx.lanl.gov/form
http://hxxp://www.energystar.gov/index.cfm?fuseaction=dishwash.search_dishwashers
http://hxxp://www.courts.mo.gov/casenet/cases/searchCases.do?searchType=name
http://hxxp://www.nal.usda.gov/fnic/foodcomp/search/
http://hxxp://wireless2.fcc.gov/UlsApp/UlsSearch/searchAmateur.jsp
http://hxxp://www.gao.gov/docsearch/keyword.php
http://hxxp://www.ca5.uscourts.gov:8081/
hxxp://www.medicare.gov/NHCompare/Include/DataSection/Questions/SearchCriteria.asp?version=default&browser=IE|6|Win2000&language=English&defaultstatus=0&pagelist=Home
http://hxxp://scoweb.sco.ca.gov/UCP/
hxxp://www.ce9.uscourts.gov/web/newopinions.nsf/f606ac175e010d64882566eb00658118/$searchForm?SearchView
http://hxxp://www.nsf.gov/awardsearch/
http://hxxps://fortress.wa.gov/esd/worksource/AdvancedJobSearch.aspx
http://hxxp://wireless2.fcc.gov/UlsApp/UlsSearch/searchLicense.jsp
http://hxxp://www.yorkcounty.gov/search.htm
http://hxxps://nevadatreasurer.gov/ucsearch/
I hope it's going to work for you too.
Cheers,
kubel
