Today I began searching around for XSS flaws, I searched for standard errors in several websites while handling script inputs. As expected I found more and more websites being vulnerable to this type of attack, but for my surprise even very popular sites are vulnerable to this standard vulnerability!
Here you have the complete list of all sites I found in only a few hours:
I just used those two scripts to check the vulnerability in input fields:
1) < script > alert ( 31337 ) < / script >
2) < script > alert ( " XSS " ) < / script >
And now its up to you ;) Go to the following sites and type the XSS examples from above into the search field =)
(without the whitespaces of course...)
FEEDBACK: vx.sky.out [at] gmail [dot] com