Since its patched now, Here is some live XSS on gaiaonline.

Found it the other day.
Told XiRaX about it earlier today, And as of about....5 minutes ago, Patched.

But, for those of you in underground silver who saw my documenting of XSS properties in gaiaonline, this should give you some insight.

It worked out Very well, In this video I only did two demonstrations, One was the html of gaia`s cashshop history viewer (AKA email exploit) And the other was just the d8silo index.

Amazing how quick gaia is at patching, Probably a good thing too, This could have raised some hell.

Smooth move, Aleena.

Everything we touch on Gaia get's patched. We should of took action while we had the chance.

The UnIntelligible wrote:

Smooth move, Aleena.

Fix`d
thankies sir.

Edit:
Fixed XXS

The UnIntelligible wrote:

Smooth move, Aleena.

Not everything can be held onto. Smart one. Atleast he posted about it. And not just kept it to himself. Learn how to be a good new member. moteSerious:

Skrillex wrote:

Not everything can be held onto. Smart one. Atleast he posted about it. And not just kept it to himself. Learn how to be a good new member. moteSerious:

Huh. ?

Skrillex wrote:

Not everything can be held onto. Smart one. Atleast he posted about it. And not just kept it to himself. Learn how to be a good new member. moteSerious:

...? I dont think he was insulting me o.0
Though if he was *shrugs* Whatever he needs to feel good about himself.

Its not like I dont have a handfull of other exploits still functional.


Here are some of my toys found and patched in the last two months
--------------------------------------
Banning users from flashgames using moddog
Admin panel access
Email / cash purchase history lookup
Send false ban requests in moddog
Cashshop editor
Create secondary password
Crypto bypass method for secondary password
Enabling / Disabling admin panel functions for public use
Enabling / Disabling test server public use.
Editing / Creating pages in gaiaonline
Editing event pages
And today, XSS through the event editing page

Hell, There are still exploits not patched.
(Only posting one which I posted publicly last week, Others stay UG)
http://gaiaonline.com/admin/flash/vj_utils.swf

And dont worry, I will toss out some more stuff in UG in the near future, Just trying to decide what would be a good one to start with that wouldn't adversely effect the others.

Skrillex wrote:

Not everything can be held onto. Smart one. Atleast he posted about it. And not just kept it to himself. Learn how to be a good new member. moteSerious:

Wasn't what I meant by 'smooth move', but OK.
Anyways, just an FYI - I've been here longer than you have.

The UnIntelligible wrote:

Wasn't what I meant by 'smooth move', but OK.
Anyways, just an FYI - I've been here longer than you have.

Just a FYI Looks like you made a account and left. Then came back all of a sudden. Date you joined doesn't mean anything.

Skrillex wrote:

Not everything can be held onto. Smart one. Atleast he posted about it. And not just kept it to himself. Learn how to be a good new member. moteSerious:

Oh, but it does mean something when you directly stated that I'm a new member. Which was false, might I add. Something ironic to throw on-top of that is the fact that I've been here longer than you, which gives you no sense of entitlement whatsoever to tell me what you told me.

The UnIntelligible wrote:

Oh, but it does mean something when you directly stated that I'm a new member. Which was false, might I add. Something ironic to throw on-top of that is the fact that I've been here longer than you, which gives you no sense of entitlement whatsoever to tell me what you told me.

You know. I like your user title. The UnIntelligible
I'm new

Kids, don't make me lock another thread.

Drakonid wrote:

Kids, don't make me lock another thread.

I sowwy Drak. I be good now. Okz? I just wanted my opinion to go out.

Yee. We don't want a 1337 thread like this being locked, now do we?
But just so you know, Skrill, your opinion(s) will and always will be absolutely meaningless. Just putting that out there so you know that what you said/say isn't worth getting this thread locked over.

I lol'd .

The UnIntelligible wrote:

Yee. We don't want a 1337 thread like this being locked, now do we?
But just so you know, Skrill, your opinion(s) will and always will be absolutely meaningless. Just putting that out there so you know that what you said/say isn't worth getting this thread locked over.

You said the right word for u coming in here like u are god..... Meaningless

Just stop this shit, holy fuck.

Drakonid wrote:

Kids, don't make me lock another thread.

Thanks drak, You know I dont like my threads closed.

Everyone kiss and makeup now.