Hacker News Reader

Can anyone explain what I'm actually supposed to see here? Screenshots of some directory names dont really mean anything unless you already understand what they mean

View on HN

Each of the screen shots shows the XSS vulnerability in action. IE: all of the alert/confirm pop-ups you see on the screenshot are not supposed to be there, they've been injected through an XSS vulnerability.

The assumption is if you can cause an alert to display, you can (probably) run AJAX requests and actually get some data/do some damage.

Thanks for the explanation

You can see from the dialog windows, that he could inject javascript.

Actually the dialogs are JavaScript provided by Apple, e.g. that prompt() on first screenshot.

No it's not. Look at the address bar. He injected that image tag with a value that would cause an error (the x value as opposed to a valid image url) which triggers the onerror javascript to execute. In this case it prompts the user but it could have been anything really.

I think you completely missed my point. I am simply pointing out prompt()is provided by Apple just like alert() provided by JS itself.

Before coming to a conclusion that you can point to and say someone is wrong, please understand that not everyone here is a master of English.

prompt() is a built in JavaScript function just like alert(). It isn't Apple specific, that's my point.

Reply on news.ycombinator.com