[TUTORIAL] Stealing Cookie with XSS

***W0lf*** · 2012-07-02T21:15:23+00:00

Introduction I thought it was about time for someone to post a cookie stealing tutorial, so I decided to write one for you from the ground up. NOTE: Again... this was written to educate you on the security aspects of the following information, not to teach you how to break the law or do something stupid. Use what you learn from this to make your website more secure/use better browsing habits, not break into other websites. Background First we need to understand a bit more about how XSS actually works before moving on. Let's say a web page has a search function that uses this code: Name We want to exploit this page using XSS. How do we do that? We know that we want to inject our own script into the value field (this field is tied to the search box we can enter text into). We could start by using a test script: alert("test") When we enter this into the search box and click search, nothing happens. Why? It's still inside the value quotes, which turn the entire script into plaintext. If yo

bunnyears Offline

F&#K MTGOX

Posts:

306

Threads:

Credibility:

000

Popularity:

βytes:

β 0

Game XP:

#16

Aug 31, 2013 04:44 PM (This post was last modified: Aug 31, 2013 04:45 PM by bunnyears.)

Obviously copied and pasted lol... none the less thanks for sharing.

(Aug 31, 2013 02:14 PM)|30RNE Wrote: soo, what can you get from cookie stealing? passwords?

Yes, you can hijack the admin's session with cookies meaning you will be logged in as admin.

Next Oldest | Next Newest

Previous 1 2

New Reply

Possibly Related Threads...
Thread / Author	Replies	Views	Last Post
[XSS] Pornhub.com - Persistant XSS - core Domain [PoC] (fixed, img-links updated). by Gee4rceApr 19, 2021 06:47 AM	26	4,047	Apr 19, 2021 06:47 AM Last Post: theghostofgreen
[XSS] script for cookie grab by Tessaiga88Sep 14, 2020 05:09 AM	0	204	Sep 14, 2020 05:09 AM Last Post: Tessaiga88
A great Xss Scanner(has found 500+ xss) by longwenzhangDec 12, 2019 07:54 AM	0	225	Dec 12, 2019 07:54 AM Last Post: longwenzhang

Login
Username/Email:
Password:	Lost Password?
	Remember me