[Niely]

I used these things to show it's dangerous:
Cookie-stealing
Phishing
Malware download
Browser exploits
Dangrous rejections
...

If someone would matter. :)

[Jeremy White]

I know that you have already noted cookie stealing, but you should really explain how dangerous cookie stealing really can be if used in the correct situation - just saying.

[Niely]

^In my report I give examples and clear explanation of what those things are. :)

[c00perzz]

depending on the website, cookie-stealing can be disastrous

if the authorisation service only depends on the cookie without any other validations etc then

Scenario 1:

1. Steal user cookies
2. If website has forms you can manipulate requests to upload malicious file (shelll) instead of images etc
3. If you have shell you can probably root the server

Scenario 2:

1. Steal ADMIN cookies
2. Upload shell through admin panel
3. root server

keep in mind that not many websites use tokens for authorisation so a very big number of current websites are prone to "disastrous" cookie-stealing

[Niely]

depending on the website, cookie-stealing can be disastrous

2. If website has forms you can manipulate requests to upload malicious file (shelll) instead of images etc

Could you give the JS example of that? I'm really wondering how I'd do that. :)

[c00perzz]

Could you give the JS example of that? I'm really wondering how I'd do that. :)

heh , i didnt mean to do that with XSS directly

with XSS you would steal the cookie.

then with the cookie you would login to that user's account and from there you would go to any form that allows uploading files and manipulate POST request to the server (using tamper data or live http headers etc) to upload the shell

[Niely]

heh , i didnt mean to do that with XSS directly

with XSS you would steal the cookie.

then with the cookie you would login to that user's account and from there you would go to any form that allows uploading files and manipulate POST request to the server (using tamper data or live http headers etc) to upload the shell

Ah, that only works if you are able to upload PHP-files.
It needs to have an upload form for that though.

[๖ۣۜCriminal]

I used these things to show it's dangerous:
Cookie-stealing
Phishing
Malware download
Browser exploits
Dangrous rejections
...

If someone would matter. :)

Don't you mean dangerous redirections?

[Zabuza]

I believe that you could technically deface a site with XSS by displaying HTML over the rest of the page with a site like C99.nl. The only issue is that it is non persistent, but you could send them the URL with the code in it. If they are stupid enough they will fall for it.

[Niely]

^Yeah probably, but defacing isn't really an issue because it's non-persistent. :)

[Abdilo]

You could use beef                                   

[EPIXIA‏‏‏‏]

You can do pretty much everything with reflected xss as you can with persistent. There are some pitfalls like browser protection and you'd have to a bit more social engineering. Anyways, you can always use html5's window.history.pushState to hide the url after it's clicked.

[pwntoken]

use SOTF, aka Shell of the Future, google it and PM me if you found this useful.

[Niely]

^Thanks a lot!
Never heard of it before, but I'll keep it in my mind for the future.
Would like to add it but the report is already given...

Still looking for those interesting suggestion for in the future!

You could use beef                                   

Yeah, I've included the BeEF framework in browser-exploits. :)