[TuT] - SQLi to XSS - [TuT]

zer0pwn · 2012-01-06T00:35:55+00:00

[color=#FF0000] - SQLi to XSS - Hello all of Hack Forums, I decided to post another tutorial on XSS. This tutorial will be involving SQLi aswell though. I will teach you how to get XSS, out of ANY SQLi vulnerable site. This method is very useful for sites that don't have any useful information stored. You can use this method to get the administrator's cookie quite easily Starting Off So first of all, we need an SQLi vulnerable site. Just use a google dork like "inurl:event.php?id=". Once you've found a vulnerable site, SQL inject it like you would with ANY site. Now at the part where it displays the vulnerable columns, we will inject our XSS. Now, this is almost impossible for the admin to tell whether you're trying to steal his cookie or not. Usually you will do something like this: http://www.site.com/news.php?id=1337 UNION SELECT 1,2,3,4,5--+- Then it will display our vulnerable column. So, on the vulnerable column, we will add our own little comment. Now, of course the site won't a

IHateMyOldUsername
Guest

Jan 5, 2012 05:38 PM

You have to many Tutorials they are filling up my bookmarks.
But nice work very HQ tut.

Next Oldest | Next Newest

New Reply

Possibly Related Threads...
Thread / Author	Replies	Views	Last Post
[XSS] Pornhub.com - Persistant XSS - core Domain [PoC] (fixed, img-links updated). by Gee4rceApr 19, 2021 06:47 AM	26	4,071	Apr 19, 2021 06:47 AM Last Post: theghostofgreen
A great Xss Scanner(has found 500+ xss) by longwenzhangDec 12, 2019 07:54 AM	0	229	Dec 12, 2019 07:54 AM Last Post: longwenzhang
(XSS Challenge) [Medium] (XSS Challenge) by frank3nstienJul 18, 2019 10:38 PM	2	325	Jul 18, 2019 10:38 PM Last Post: frank3nstien

View a Printable Version
Export as PDF
Subscribe to this thread

Login
Username/Email:
Password:	Lost Password?
	Remember me