HTML tag abuse thread

Keith

Chrome 33 is discontinued apparently. http://en.wikipedia.org/wiki/Google_Chrome#Release_history

I suspect they discontinued it when they discovered that not all Discourse exploits worked correctly.

darkmatter

Time to reload page/clear css edits....

Matches

darkmatter

Clearly just a bug with the nested css's on that spinner I guess.
I altered all anchor tags to be spinners in css but only like 80% of the links spun, a lot of links stayed right where they were.

PJH

@Matches said:

It still spins :D

Depends on your browser.

Arantor

Who wants to take bets on how long it will be before the next such issue is found?

PJH

My bet is, based on the previous ones, before I get to work tomorrow morning.

So within the next 11 hrs. ( < 0800UTC)

Arantor

You'd think by now that we as a community would be running out of ways to break Discourse.

Onyx

@Arantor said:

You'd think by now that we as a community would be running out of ways to break Discourse.

How do you break that which never worked properly?

Arantor

By breaking it into smaller bits. There's always smithereenies to blow into more smithereenies.

Matches

https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

Get to work. I did most of the 'stock' types already in that earlier post.

Arantor

You're assuming that I can actually be bothered. Criticising Discourse is easier and more fun for me than trying to actively break it; I do enough of that with software I actually care about.

Matches

That's pretty much why I stopped with the last set. Then Macie stole my badge:(

Maciejasjmj

What can I say, slow day at work.

Oh, by the way...

A tempting attack vector on a forum with public edit history - implant your exploit, change your post to "wait, scratch that", compelling people to check out your edit to see what stupid thing you've said, and bingo, the rebake doesn't touch your XSS.

Matches

Of note, the double quote work around doesn't work as it only shows the first quote level in edit history.

Bug or feature?

Edit, Keith stop changing your avatar. I keep thinking you're a new person

darkmatter

@Maciejasjmj said:

to check out your edit to see what stupid thing you've said, and bingo, the rebake doesn't touch your XSS.

You can't see other people's edits with current wtdwtf current settings.
However, they need to fix that for other people's forums

Keith

@Matches said:

Edit, Keith sop changing your avatar. I keep thinking you're a new person

Would you like me to revert to the creeper, the bo-bomb, or purple and brown?

Matches

Green creeper

DoctorJones

@Matches said:

Green creeper

Yay, the old @Keith is back

Filed under: I don't know who that new Keith was, but he wasn't as funny as you man...

Keith

@DoctorJones said:

Yay, the old @Keith is back

I'm worried that I've become pigeon-holed and won't be able to get any serious forum work.

DoctorJones

@Keith said:

won't be able to get any serious forum work

Bah, who needs a serious forum when you've got this place

Filed under: I mean like seriously

DoctorJones

The santa hat really sells it

xaade

Here

I've created some blocks and a tool to merge them with.

All your changes have to be using the following recipes:

Mud + Stone = }
Wood + Stone = <>

and so on.

Happy coding.

xaade

How to stall a stupid forum troll?

Next post...

xaade

Comment Loading....

tufty

Testing... Does this notify?

<a @tufty

And this?

@tufty

Matches

Testing... Does this notify?

<a @tufty

I would imagine yes, because the @ breaks the html. But you can't notify yourself.

Matches

<a title="@tufty Quote reply mine, and be amazed.

The baked post and the preview post show different things.

tufty

OK. what I was getting at is that I can use the "in a tag" approach to get something that ordinarily wouldn't @tag to <a @tag, and I was wondering if it would provide a nifty back-end attack (on the grounds that the notification is generated in-system and thus likely to be less sanitised - so providing an <a @little_bobby_tables tagging attack)

Matches

Arantor or darkmatter (can't remember which) have quote bombs lying around that look normal but when quoted tag people. I would focus on the image parser if you are looking for a server side attack.

Matches

[spoiler]<a @tufty [/spoiler]

tufty

Meh, remote code execution is passé.

I want to fuck up the database structurally. Make an actual infinite topic :)

But fuck that for the moment. Time for bed.

Arantor

Given Discourse's attitude that might not even be impossible.

darkmatter

@tufty said:

OK. what I was getting at is that I can use the "in a tag" approach

I've been doing the <a @eff_you</a> fake tag thing for days now.
<a href="http://somehackerwebsite.com" @eff_you

Matches

[spoiler]<a @Arantor @darkmatter [/spoiler]

Onyx

So, to ~~counter~~help duplicate all this madness:

function viewRaw(postID)
{
    var topicID = window.location.pathname.slice(0, window.location.pathname.lastIndexOf('/'));
    topicID = topicID.slice((topicID.lastIndexOf('/') + 1));

    document.location.href = 'http://what.thedailywtf.com/raw/' + topicID + '/' + postID;
}

$('.fa-link').each(function(index) {
    var postID = $(this).closest('button').attr('data-post-number');
    
    $(this).closest('.actions').prepend('<button onclick="viewRaw(' + postID + ')"><i class="fa fa-code"></button>')
});

Anyone have any ideas on how to trigger this without killing the poor browser?

M_Adams

My JS-fu is not working today, but could you amend the $('.fa-link')... section to also add a '#' + postID to show the postID like #293 or maybe even as #1269:293 by sticking topicID in there too?

Onyx

Possibly sleepiness, but I don't see what you're trying to achieve with that? You mean just for display purposes? Currently it adds a code icon in front of the like icon that takes you to raw version of the post. Should make it open in new tab though.

M_Adams

@Onyx said:

Possibly sleepiness,

Possible "didn't speak clearly" :) Yah, just for display purposes. In front of the code icon, would WFM...
I sometimes hand code the [quotes] stuff 'cause ya' know Discsores… And being able to see that info would be sweet.

Onyx

Yeah... I like that.

var topicID = null;

function getTopicID()
{
    if(topicID === null)
    {
        topicID = window.location.pathname.slice(0, window.location.pathname.lastIndexOf('/'));
        topicID = topicID.slice((topicID.lastIndexOf('/') + 1));
    }
    
    return topicID;
}

function viewRaw(topicID, postID)
{
    window.open('http://what.thedailywtf.com/raw/' + topicID + '/' + postID, '_blank');
}

$('.fa-link').each(function(index) {
    var postID = $(this).closest('button').attr('data-post-number');
    var topicID = getTopicID();
    
    $(this).closest('.actions').prepend('<button onclick="viewRaw(' + topicID + ', ' + postID + ')">#' + topicID + ':' + postID + '&nbsp;<i class="fa fa-code"></button>')
});

Formatting is a subject to change. Also, opening in new window / tab now, depending on your browser settings.

Now if I could only figure out if there's an event I can catch when new posts get loaded into DOM that's not too taxing on the browser...

Edit: Changed to use a global var. Yes, I know, evil, but avoids string parsing for every element. Also, JS is evil in itself anyway.

Incidentally, I tried setting it to undefined instead of null (tired, 1AM...), the error was amusing:

ReferenceError: undefinded is not defined

Yes, FF, I agree. Well done.

M_Adams

Unable to currently like_{…because…}, have set reminder :)

Edit: Done!

ben_lubar

Click the timestamp or the share button. There's already the post number in there.

Arantor

Because that's obvious

ben_lubar

Where would you expect to find the text "share a link to post #%d"?

Arantor

Well done for misinterpreting what I was getting at.

I would expect the share al ink to post x to be the share icon. I would, however, expect the 'post x' information to be visible without having to click anything, but this is clearly a barrier to informed discourse.

ben_lubar

@Arantor said:

I would, however, expect the 'post x' information to be visible without having to click anything

Does any forum software do that? I've never seen it.

M_Adams

@ben_lubar said:

Click the timestamp or the share button. There's already the post number in there.

That's soooo totally not the point. When composing a post why should I stop typing, mouse all over the fucking place going clicky-clicky-click?

M_Adams

@ben_lubar said:

Does any forum software do that? I've never seen it.

In partial form? Yes.

Meanwhile, this whole pile of is a huge monument to "Does any forum software do that? I've never seen it.".

So one more item, that makes you go "WTF??" ‽

ben_lubar

@M_Adams said:

In partial form? Yes.

Is that a VB forum running on PHP?

"We like Microsoft programming languages, but not enough to use them in production."

M_Adams

Yes specifically geared to VBA in fact.

Now, I use VBA a lot. But I understand if it makes some people woozy: