[zer0pwn]

[TuT] - File Upload to Persistent XSS - [TuT]

Hi guys, I made a tutorial sort of like this this morning. Except it's with HTML Forms to persistent XSS. In this tutorial, I'll be explaining how you can get persistent XSS from a simple file upload. You can do it with any file extension too (prefferably an image file (.png, .jpg)). This is sort of the same method as in my other tutorial, we will need Tamper Data again.

So first of all, let's find a vulnerable page. I'm not sure if this method is public or not (I'm sure it is, because it's not a bad idea, except I haven't seen it around). I actually tested this method on an XSS challenge made by a friend of mine (ring0_).

Once you've found a vulnerable site (It'll be hard to tell if it's vulnerable or not though.) open select your file. I will choose a file "TrollFaic.png". I actually have that file on my PC, and I do use it for this LOL. Now, open tamper data, and start tampering. Once you find the right request to edit, edit it. Change the file name to "<img src=javascript:alert("XSS");>.png". If a broken image pops up instead of an alert, use this vector: "<img src="XSS" onerror=alert("XSS");>.png". That should do it.

As long as the file stays there, it should keep shooting up alert boxes. If you have any questions, requests, or comments, just PM me and I'll get back to you as soon as I can!

Thanks for reading this tutorial!

[FastFive]

good tutorial... going to try this soon.

[1n54n3]

Good tutorial mate.
Trying to do this one too.

[Ichi]

Once again, great tut bro. Keep em coming

[rAtoN]

Can you put images and a example of a shell lol

[.Satan]

Do you have a website to use as an example?

[zer0pwn]

http://onlinescan.avast.com/

Try that for now :D

[.Satan]

Couldnt find the thing to edit within the time before the scanner said file to big :(

also http://vscan.novirusthanks.org/analysis/...zLXBuZw==/ didnt work, would hex bypassing work?

[zer0pwn]

It might, I'll try it.
That's a good idea :)

[bluebknight]

You can also upload the file first and then use the rename function to rename to something like the OP posted.

My mediafire XSS worked like that.

[Girby2K11]

Nice tutorial, clearly explained. Well done.

[IHateMyOldUsername]

Thanks for posting this it helped alot!

[BeggFoMercy]

Really great and hard work mate keep it up <3

[rand0]

Heheh :) This makes a lot of sense, working off of the old IMG xss vector. Nicely done. I never thought of this.

[Ashutosh.panda]

can you plz detailly expalin how to open a image file and edit it to test xss