Javascript injection 04-07-2011, 08:47 PM
#1
Hello,
This are just little know hows, for javascript injection, cookie and form hacking, that i've compiled on a work i did a while ago. I hope it can be usefull for anyone
Javascript Injection – Know Hows
The javascript protocol is enabled by running on an empty browser bar: “javascript :<injection command>â€ÂÂ;
• Most used injection commands: “alert()†and “void()â€ÂÂ
• Always split/end the commands with a semi-colon “ ; â€ÂÂ
• Javascript injection allows you to change a website content without leaving the site, reloading the page or saving the site to your desktop
• It can be useful when you need to change hidden data before you send it to the server
Cookie Hacking:
• To see if the site is using cookies, and what cookies, use the tag “document.cookieâ€ÂÂwith the “alert†command
• To edit a cookie, we use the “void†command. The “void†command is used to return a null value, so the browser will not be able to load a new page
Form Hacking:
• “form†hacking can be achieved in several ways
• Most of the time, you can save the source from the page in your computer, and edit the HTML on it, submitting the edited “form†from your computer to the web server
• Many web developers have tighten up the security around this, so this is where JS Injection can come in handy
Example of “form†hacking:
On the target website we check the source and see the “form†appear like this:
<form action=â€ÂÂhttp://www.hackablesite.com/submit.php†method=â€ÂÂpostâ€ÂÂ>
<input name=â€ÂÂprice†type=â€ÂÂtext†value=â€ÂÂ1000†/>
So we use a Javascript Injection like this to change the “1000†value to “10â€ÂÂ:
javascript :void(document.forms[0].price.value= 10); alert(document.forms[0].price.value);
In the above code we change the price field using javascript to retrieve the value of the hidden field and setting that value to 10. An alert box is then popped to let us know for sure that the value has been changed.
This attack can be used on more than hidden fields like select menus or any other “form†items.
I hope it proves to be useful for anyone at some times
My best regards,
Azkrath
*edit: Grammar correction
*p.s.: using javascript form hacking, the ":" are near the word "javascript", without a space. However in here i can't use it like that, as it will only appear a "j" instead of the full "javascript :"
This are just little know hows, for javascript injection, cookie and form hacking, that i've compiled on a work i did a while ago. I hope it can be usefull for anyone
Javascript Injection – Know Hows
The javascript protocol is enabled by running on an empty browser bar: “javascript :<injection command>â€ÂÂ;
• Most used injection commands: “alert()†and “void()â€ÂÂ
• Always split/end the commands with a semi-colon “ ; â€ÂÂ
• Javascript injection allows you to change a website content without leaving the site, reloading the page or saving the site to your desktop
• It can be useful when you need to change hidden data before you send it to the server
Cookie Hacking:
• To see if the site is using cookies, and what cookies, use the tag “document.cookieâ€ÂÂwith the “alert†command
• To edit a cookie, we use the “void†command. The “void†command is used to return a null value, so the browser will not be able to load a new page
Form Hacking:
• “form†hacking can be achieved in several ways
• Most of the time, you can save the source from the page in your computer, and edit the HTML on it, submitting the edited “form†from your computer to the web server
• Many web developers have tighten up the security around this, so this is where JS Injection can come in handy
Example of “form†hacking:
On the target website we check the source and see the “form†appear like this:
<form action=â€ÂÂhttp://www.hackablesite.com/submit.php†method=â€ÂÂpostâ€ÂÂ>
<input name=â€ÂÂprice†type=â€ÂÂtext†value=â€ÂÂ1000†/>
So we use a Javascript Injection like this to change the “1000†value to “10â€ÂÂ:
javascript :void(document.forms[0].price.value= 10); alert(document.forms[0].price.value);
In the above code we change the price field using javascript to retrieve the value of the hidden field and setting that value to 10. An alert box is then popped to let us know for sure that the value has been changed.
This attack can be used on more than hidden fields like select menus or any other “form†items.
I hope it proves to be useful for anyone at some times
My best regards,
Azkrath
*edit: Grammar correction
*p.s.: using javascript form hacking, the ":" are near the word "javascript", without a space. However in here i can't use it like that, as it will only appear a "j" instead of the full "javascript :"
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
