+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Question] Sellfy Hack XSS (/showthread.php?tid=5186647)
[Question] Sellfy Hack XSS - SIM-2988035 - Feb 28, 2016
Hello Hackforums,
If I post this thread today, it's to ask a question. I recently saw that a few people managed to hack the website sellfy.com using simple Cross Site Scripting.
I'm very interested in knowing how these people might of performed this hack. Is there a kind soul that could explain to me what is Cross Site Scripting and tell me what tools/tutorials and whatever else I need to know to make a XSS on this website.
Thank you ! And any answer, video, picture, link or anything regarding my question would help !
* - SlimJimTheHunter - Feb 28, 2016
XSS is when unsanitized input is passed to a page and so becomes part of the makeup of the page in some form. This input is usually retrieved by POST or GET forms utilised by the webpage such as a search bar. An attacker will look to utilise XSS when characters such as " > / < are allowed, however there are many complex ways of performing XSS called vectors. The end result is to be able to input an attackers own code to perform a multitude of actions, the most common of which is stealing a legitimate site members or admin's cookies which can then be used to hijack his session and gain access without actually needing a password. There are two types of XSS, stored which is when code is indefinitely placed into a code for multiple users to see and potentially access, reflected however is when the injected code is only available at the time of the request and so a generated link must be sent to a victim. To learn more just search XSS using the search bar
* - SIM-2988035 - Feb 28, 2016
Thanks a lot SlimJimTheHunter !! A friend of mine also sent me a youtube playlist with videos that explain XSS, I haven't watched them yet but if other people have the same question as me and want to check it out, here is the link: w w w . youtube.com/playlist?list=PL1A2CSdiySGIRec2pvDMkYNi3iRO89Zot
* - Gee4rce - Feb 28, 2016
Here in this Forum we have also a lot of tutorials which cover XSS (besides other techniques),
for a good XSS Tut, click here and scroll down to XSS, choose the first one (by MaXone) and read it:
https://hackforums.net/showthread.php?tid=2008347&highlight=Megathread
If you read and dont unterstand something, then you can ask back here of course, or even pm me for specific questions.
Cheers, Gee.
* - SIM-2988035 - Feb 29, 2016
(Feb 28, 2016 03:27 PM)Gee4rce Wrote: Here in this Forum we have also a lot of tutorials which cover XSS (besides other techniques),Wow that's a lot of tutorials !! Thanks a lot man I'm sure it will be very helpfull <3
for a good XSS Tut, click here and scroll down to XSS, choose the first one (by MaXone) and read it:
If you read and dont unterstand something, then you can ask back here of course, or even pm me for specific questions.
Cheers, Gee.
* - Gee4rce - Mar 1, 2016
(Feb 29, 2016 01:24 AM)adhyft Wrote: Wow that's a lot of tutorials !! Thanks a lot man I'm sure it will be very helpfull <3
No problems, i am glad you recognise the value of that collection. 🤝
Cheers, Gee.
* - CrackPotShot - Mar 1, 2016
(Feb 28, 2016 03:27 PM)Gee4rce Wrote: Here in this Forum we have also a lot of tutorials which cover XSS (besides other techniques),yo so may tutorials 🤝🤝😶
for a good XSS Tut, click here and scroll down to XSS, choose the first one (by MaXone) and read it:
If you read and dont unterstand something, then you can ask back here of course, or even pm me for specific questions.
Cheers, Gee.
* - Gee4rce - Mar 1, 2016
Yes, it's one of HF's biggest, i also learned from a lot of the listed ones.
Bookmark it guys 🎉
* - SIM-2988035 - Mar 2, 2016
Yup I did ;-) and btw if I can exploit a sql vulnerability can I upload a shell ?
* - Gee4rce - Mar 3, 2016
This depends,
if the user that runs the SQL Server has writing permissions you could shell the server via INTO_OUTFILE method.
Chances go up if you are allowed to use querries like INSERT, UPDATE, etc. where you can write into the DB.
Another thing would be LOAD_FILE, you can include local files and depending on server configuration you
could eventually combine that with logfile poisoning.
So to answer your question; in general yes, but not in all cases and it strongly depends on how the server is configured.
Cheers, Gee.
* - SIM-2988035 - Mar 3, 2016
Humm.. I'll check that out more in detail. Thank you !!