Sometimes making fun of people using xss tricks can be very entertaining. Today I will talk about xlovecam.com, a belgian adult videochat website with huge amount of traffic from France.

Our purpose is to make models believe that their accounts are suspended. For them this means a lot of money and time wasted.

Some real examples:
http://img339.imageshack.us/img339/5881/buahahahaq.png
http://img706.imageshack.us/img706/2575/hihihihiz.png
http://img227.imageshack.us/img227/2604/pwnedd.png
http://img534.imageshack.us/img534/2424/95603479.png

How to do it:

Go to http://www.xlovecam.com and register a new account.
Log in using the new account.
Open http://iphone.xlovecam.com in another browser instance and login there too.
Go in a girl room from the iphone page.
Search the same girl on xlovecam.com front page (check page footer for the entire list of online models) and go in her room to see her reaction after everything is completed.

Now from the iphone page we will use basic html and some javascript to pwn that chatroom. Iphone chat interface is vulnerable to cross site scripting so it will be easy.
First of all I need to use a different font to catch the model attention because in normal circumstances all users type with the same font. So I just type this in her iphone chat room and she will see a text like the one from my screencaps.

How to make this prank more convincing? We use a little code from RSnake xss cheatsheet to freeze her room. No one including the model will be able to write anything in the chat. This little piece of code affects many flash based chatrooms so you can test it in another circumstances too. Btw, you can see on that iphone page what she will try to type, but in normal chat nothing will appear.

So the final version of the code looks like this http://pastebin.com/QtiWnS1s. With a simple copy/paste you can make fun of them when you are bored. Of course you could use that iphone subdomain to redirect visitors from the room (if they are using iphone interface) or steal their cookies but most of the users use the normal site interface not the iphone subdomain.

Other tricks:

In the rooms type html tags like <i><u><b> but don’t close them. You will see by yourself what’s the catch.

Related Posts

• April 29, 2010 -- Camera de supraveghere a universitatii Alexandru Ioan Cuza din Iasi
• April 19, 2010 -- Oare functioneaza?
• April 19, 2010 -- Din nou metoda “uber hacking” – craigslist.org
• November 24, 2009 -- Rezultatele poll-ului despre Hi5
• November 13, 2009 -- Britney Spears loves Satan