Hacker News Reader

XSS Proof of concept. I've injected javascript into this page:

Escape your inputs properly or suffer cookie stealing and session hijacking XSS attacks.

I could have put something on that page to steal your cookie contents. Would I have been able to do anything interesting with this interesting looking page as an admin user?

http://debate-zone.com/admin

Thanks for testing this stuff out! That admin page is actually broken, I don't actually have a working admin page. As for the XSS stuff, I'm going to go fix that.

Reply on news.ycombinator.com