Waraxe IT Security Portal

3ubz · Beginner

good day

Im very much curious on how critical XSS really is. Ive read from some sources that an attacker can break in to the server and take
control of it by just using XSS attack. I just cant understand how is it possible for them to do that. I've been searching the internet on this topic but too bad i just cant find the right explanation. Can you someone please explain it to me how do an attacker using XSS method can get into the web server and take over the server. How do they can execute commnads and put a backdoor files into the server using XSS codes. I know that file insertion can cause real harm to the server and can allow an attacker to
hack into the server by inserting a php shell into the server, but how about XSS codes? What kind of XSS codes do they use for this? Can u provide example of XSS Code they used? I have tried cookie stealing but i guess it wont let an attacker hacked the web server it self if im not mistaken. Correct me if im wrong. Sorry for being paranoid, i just dont want this thing happen to my server Smile

Thank you very much!! Smile

schnibble · Regular user

What XSS can give you usually is cookie data for cookie insertion (posioning). With that you can simulate other person, which could have some kind of admin rights. With admin rights (on forum, cms, or any other system) you could upload, execute, dump database or browse folders, which in the end could lead to gaining full shell root rights. It's all dependant on system, and doesen't have strait forward instrucitons.

But any escelation of rights could theoretically lead to server take over.