+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: XSS2SHELL - Leverage XSS to RCE in a matter of seconds on Wordpress (/Thread-XSS2SHELL-Leverage-XSS-to-RCE-in-a-matter-of-seconds-on-Wordpress)
Pages:
1
2
XSS2SHELL - Leverage XSS to RCE in a matter of seconds on Wordpress - Dyme - 07-31-2014
Info and source: https://github.com/Prochainezo/xss2shell
RE: XSS2SHELL - Leverage XSS to RCE in a matter of seconds on Wordpress - Oni - 07-31-2014
I'm surprised there aren't any replies. Interesting video. I like how you've taken what would normally be a minor vulnerability and turned it into a major one. I don't know a load about Wordpress, but I will be looking at the source. Nice share!
Edit: Lol wowo nice
RE: XSS2SHELL - Leverage XSS to RCE in a matter of seconds on Wordpress - Adorapuff - 08-01-2014
So if there is an xss on a wordpress theme, executing this via scr="foreginhost.com/out.js" would cause a shell on the wp site?
RE: XSS2SHELL - Leverage XSS to RCE in a matter of seconds on Wordpress - Losi - 08-01-2014
Props for the filthy frank background song. Good shit Dyme.
RE: XSS2SHELL - Leverage XSS to RCE in a matter of seconds on Wordpress - Dyme - 08-01-2014
(08-01-2014, 06:40 AM)Adorapuff Wrote: So if there is an xss on a wordpress theme, executing this via scr="foreginhost.com/out.js" would cause a shell on the wp site?
You betcha. Any XSS vulnerability on the site will get you a shell.
RE: XSS2SHELL - Leverage XSS to RCE in a matter of seconds on Wordpress - Eclipse - 08-01-2014
So this allows you to get a shell from any XSS vulnerability? Seems like not many people have seen it yet. Awesome share!
RE: XSS2SHELL - Leverage XSS to RCE in a matter of seconds on Wordpress - Crypt - 08-01-2014
Zeekill mentioned something similar (if not the same thing) to this the other day on HF. It had to do with executing php inside the alert box.
Thanks for not being a dick and sharing this with everyone.
RE: XSS2SHELL - Leverage XSS to RCE in a matter of seconds on Wordpress - Adorapuff - 08-01-2014
Here's some public wordpress vulns that you guys can go through and try and find xss in here. http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=wordpress&filter_exploit_text=&filter_author=&filter_platform=0&filter_type=0&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=
RE: XSS2SHELL - Leverage XSS to RCE in a matter of seconds on Wordpress - Eclipse - 08-01-2014
(08-01-2014, 07:03 PM)Adorapuff Wrote: Here's some public wordpress vulns that you guys can go through and try and find xss in here. http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=wordpress&filter_exploit_text=&filter_author=&filter_platform=0&filter_type=0&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=
I was going to post just that.
RE: XSS2SHELL - Leverage XSS to RCE in a matter of seconds on Wordpress - Alan Turing - 08-04-2014
(08-01-2014, 06:08 PM)Crypt Wrote: Zeekill mentioned something similar (if not the same thing) to this the other day on HF. It had to do with executing php inside the alert box.
Thanks for not being a dick and sharing this with everyone.
hes on hf again? jeez