+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: a question about (PHPSSID) in Cross site scripting vuln (/showthread.php?tid=5839405)
a question about (PHPSSID) in Cross site scripting vuln - r3el - May 21, 2018
i was scaning my target using acunetix
then i found Cross site scripting vuln and when i open HTTP editor i found something like this
Code
Cookie: PHPSESSID=okgneookt4q3tvi0g74136mbl2; nws_290=1314RE: a question about (PHPSSID) in Cross site scripting vuln - 0xB9 - May 21, 2018
(May 21, 2018 06:58 PM)r3el Wrote: my question is : this is the cookies of the admin ?
No, that's yours.
RE: a question about (PHPSSID) in Cross site scripting vuln - r3el - May 21, 2018
(May 21, 2018 07:17 PM)0xB9 Wrote: No, that's yours.
ok thnkx, and when i find the PHPSSID of the admin , how can i use it ?
( and after thah : i'm trying to hack myself in local host , i got my PHPSSID but i dont know how can i use it to hack myself ? )
RE: a question about (PHPSSID) in Cross site scripting vuln - SIM-964740 - May 21, 2018
(May 21, 2018 07:48 PM)r3el Wrote: ok thnkx, and when i find the PHPSSID of the admin , how can i use it ?
( and after thah : i'm trying to hack myself in local host , i got my PHPSSID but i dont know how can i use it to hack myself ? )
With XSS you are meant to inject it into the server such as on comment forms and such (where when you post data it stays on the website), and your script should post data back to you. So for example you could find a vuln. page, inject your script to that page and direct your victims to the vulnerable page with your malicious code and your script that you make should post data of every user who loads it.
RE: a question about (PHPSSID) in Cross site scripting vuln - r3el - May 21, 2018
(May 21, 2018 10:45 PM)Deadpan Wrote: With XSS you are meant to inject it into the server such as on comment forms and such (where when you post data it stays on the website), and your script should post data back to you. So for example you could find a vuln. page, inject your script to that page and direct your victims to the vulnerable page with your malicious code and your script that you make should post data of every user who loads it.
i just want to know how i use the PHPSSID beacuse i got it by inject javascript code
RE: a question about (PHPSSID) in Cross site scripting vuln - SIM-964740 - May 22, 2018
(May 21, 2018 11:41 PM)r3el Wrote: i just want to know how i use the PHPSSID beacuse i got it by inject javascript code
From what you have been saying you have only retreived your own PHPSESSID. You arent going to do shit with that. Look at my other reply on your threads.