xssposed text on alerts

[tbmnull]

Hi,

another solution for XSSPOSED text on alert/confirm/prompt boxes.
as we know vendors can easily find this text on logs, so they can patch without any credit to researcher (nor thanks)
so, my suggestion is, before researcher submit an xss, maybe xssposed can give him a secret random phrase for alerting it. then researcher uses that phrase instead of XSSPOSED. or there may be random + XSSPOSED + random, you decide. and xssposed can check it, if it is valid then approves.

[x1admin]

This is a good idea to implement. We will think how to implement it.

[0x0luke]

adding onto this, couldn't a webadmin just search for alert/prompt/confirm instead?

there are always going to be companies who don't want to acknowledge researchers..

[x1admin]

After internal discussion, we decided not to implement this now.

We don't change our verification IPs, we keep the same payload strings and we encourage researchers using real names in their profiles.

We are an open, transparent and user-friendly community. If someone wants so hard to keep his website vulnerable - this is his problem and responsibility (but so far, we have very very few cases like this).

[mcurietribute]

Hi,

another solution for XSSPOSED text on alert/confirm/prompt boxes.
as we know vendors can easily find this text on logs, so they can patch without any credit to researcher (nor thanks)
so, my suggestion is, before researcher submit an xss, maybe xssposed can give him a secret random phrase for alerting it. then researcher uses that phrase instead of XSSPOSED. or there may be random + XSSPOSED + random, you decide. and xssposed can check it, if it is valid then approves.

Code: Select all

<?php
	echo(str_replace("openbugbounty", rtrim(base64_encode(md5(microtime())), "="), htmlentities("https://google.com/?q=<script>alert('openbugbounty')</script>")));
?>

I've actually found companies that does this, it's rather rude, inconsiderate, and selfish in my opinion.

But as someone else has stated, admins would be able to search for alert, prompt, and confirm to find the vulnerability in order to resolve the issue.