Hello all of Hack Forums, I decided to post another tutorial on XSS. This tutorial will be involving SQLi aswell though. I will teach you how to get XSS, out of ANY SQLi vulnerable site. This method is very useful for sites that don't have any useful information stored. You can use this method to get the administrator's cookie quite easily

Starting Off

So first of all, we need an SQLi vulnerable site. Just use a google dork like "inurl:event.php?id=". Once you've found a vulnerable site, SQL inject it like you would with ANY site. Now at the part where it displays the vulnerable columns, we will inject our XSS. Now, this is almost impossible for the admin to tell whether you're trying to steal his cookie or not. Usually you will do something like this:


Then it will display our vulnerable column. So, on the vulnerable column, we will add our own little comment. Now, of course the site won't allow any plain-text. We have to use Hex, which is a huge help in this case. So we will encrypt our XSS Vector into Hex. I suggest you do this at:


Once you've encrypted it, put it in the place of your vulnerable column. But we can't just put the hex there, we have the let the server know that we want our Hex to be decoded on it's way to the page. So we will use "0x" So basically, put "0xHEXHERE". Now hit enter.

Now you should have an alert.

NOTE: It will block the quotes, so you have to do <script>alert(/XSS/)</script>

Although, it shouldn't be a problem for our cookie logger.

That's pretty much it, I hope you guys liked it and will find it useful. If you have any questions or need any help just PM me and I'll get back to you ::)

One more thing, I'd like to thank Zer0Freak for helping me use this method (Because I didn't know how to use comments in SQL -facepalm-). Thanks Zer0Freak!