RaccoonCity's XSS Handbook - Printable Version

RaccoonCity's XSS Handbook - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: RaccoonCity's XSS Handbook (/Thread-RaccoonCity-s-XSS-Handbook)

Pages: 1 2 3

RE: RaccoonCity's XSS Handbook - ralf93 - 06-08-2014

It deserves a thousand thanks bro. awesome work :thumbsup:
read it whole Biggrin

always been a fond of XSS.
btw what if you find a simple HTML site with no search or comment bar?

RE: RaccoonCity's XSS Handbook - ralf93 - 06-08-2014

(06-07-2014, 11:45 PM)Jinxed Wrote: Mehehehe.. Got 4 FB accounts already! Some people are idiots

So u use a php script for facebook cookies? is the script different from this one (mentioned by Raccooncity) or the same?

RE: RaccoonCity's XSS Handbook - RaccoonCity_mybb_import13707 - 06-08-2014

(06-08-2014, 12:06 PM)ralf93 Wrote: It deserves a thousand thanks bro. awesome work :thumbsup:
read it whole
always been a fond of XSS.
btw what if you find a simple HTML site with no search or comment bar?

Well, in XSS you always have to change the website in anyway, for example in a search query or a comment.
If that comment section now is vulnerable, the code gets executed.

Even if there's no comment for example, there's always text.
Imagine a URL that looks like this:

Code:
www.website.wow/article.php?q=intrestingarticle

Now, if you were to change instrestingarticle to some HTML code like:

Code:
"><script>alert(1);</script>

you'll get redirected to a website that says that "The article "><script>alert(1);</script> was not found", and then the HTML gets executed and boom. XSS.~
That would work in some cases.
Biggrin

RE: RaccoonCity's XSS Handbook - Spirit - 06-08-2014

Thank you for sharing this handbook with HC. This was a fantastic read! If it means anything to you, it's even one of those things people share with other people when they're looking to learn about something (XSS in this case). Honestly, this was written really well. I'll be giving this a "Thanks" when I'm not on mobile.

How long did it take you to write this exactly? Just wondering. Smile

RE: RaccoonCity's XSS Handbook - RaccoonCity_mybb_import13707 - 06-08-2014

(06-08-2014, 02:33 PM)Maxx Wrote: Thank you for sharing this handbook with HC. This was a fantastic read! If it means anything to you, it's even one of those things people share with other people when they're looking to learn about something (XSS in this case). Honestly, this was written really well. I'll be giving this a "Thanks" when I'm not on mobile.

How long did it take you to write this exactly? Just wondering.

Thank you! It does mean alot! Smile

It took me a bit more than 1 day, I spent the night to start writing it and woke up and wrote the rest.
I'm glad you liked it Smile

RE: RaccoonCity's XSS Handbook - problemsolva - 06-10-2014

Thanks man this was
A really informative article to read.

RE: RaccoonCity's XSS Handbook - ralf93 - 06-10-2014

so how do you XSS a site who has no search and comment box and its links are like this example.com/contact.html
(sorry but im a noob at XSS)

RE: RaccoonCity's XSS Handbook - RaccoonCity_mybb_import13707 - 06-10-2014

(06-10-2014, 08:39 AM)ralf93 Wrote: so how do you XSS a site who has no search and comment box and its links are like this example.com/contact.html
(sorry but im a noob at XSS)

I explained this to @Jinxed before, but I can explain it again.

Let's say that the url looks like this:

Code:
www.example.com/contact.html

Now, if I would change contact.html to something random like:

Code:
www.example.com/ladkfgjlkajd

It would display a page saying that "ladkfgjlkajd" doesn't exist.
Okay, let's type some HTML in there.

Code:
www.example.com/"><script>alert(1);</script>

Now when it shows that "><script>alert(1);</script> doesn't excist, it will hopefully execute the payload. Smile

RE: RaccoonCity's XSS Handbook - ralf93 - 06-10-2014

(06-10-2014, 08:55 AM)RaccoonCity Wrote:
(06-10-2014, 08:39 AM)ralf93 Wrote: so how do you XSS a site who has no search and comment box and its links are like this example.com/contact.html
(sorry but im a noob at XSS)

I explained this to @Jinxed before, but I can explain it again.

Let's say that the url looks like this:

Code:
www.example.com/contact.html

Now, if I would change contact.html to something random like:

Code:
www.example.com/ladkfgjlkajd

It would display a page saying that "ladkfgjlkajd" doesn't exist.
Okay, let's type some HTML in there.

Code:
www.example.com/"><script>alert(1);</script>

Now when it shows that "><script>alert(1);</script> doesn't excist, it will hopefully execute the payload.

many thanks Biggrin

but i tried it and it gave me thir 404 error :p

Code:
Not Found

The requested URL /"><script>alert(1);</script> was not found on this server.

RE: RaccoonCity's XSS Handbook - RaccoonCity_mybb_import13707 - 06-10-2014

(06-10-2014, 11:36 AM)ralf93 Wrote:
(06-10-2014, 08:55 AM)RaccoonCity Wrote:
(06-10-2014, 08:39 AM)ralf93 Wrote: so how do you XSS a site who has no search and comment box and its links are like this example.com/contact.html
(sorry but im a noob at XSS)

I explained this to @Jinxed before, but I can explain it again.

Let's say that the url looks like this:

Code:
www.example.com/contact.html

Now, if I would change contact.html to something random like:

Code:
www.example.com/ladkfgjlkajd

It would display a page saying that "ladkfgjlkajd" doesn't exist.
Okay, let's type some HTML in there.

Code:
www.example.com/"><script>alert(1);</script>

Now when it shows that "><script>alert(1);</script> doesn't excist, it will hopefully execute the payload.

many thanks but i tried it and it gave me thir 404 error :p

Code:
Not Found The requested URL /"><script>alert(1);</script> was not found on this server.

Yeah, sometimes people have cutomized 404 errors.
But this was just an example, there's more ways of doing it. Smile