Hi5 and XSS Part II

Hi5 and XSS Part II

Well I've just written a proof of concept on my hi5.com profile. You need a valid login! While loading my profile, you'll auto-magically be redirected to a spoofed hi5.com page at my webserver, I won't save the information you input, but I suggest you to enter only testing info to try it out!

For the interested the proof of concept is the following:

Since no image will be loaded an onError event will be generated, and automatically the user will be re-asked to relogin, but in the fake page! Since it's not unusual to be asked to relogin at hi5.com there's a potential danger for users to disclosure their information!