XSS with Backtrack?

SecureUs

BitSec01
9 years ago

0

so with this level i think i have to do an XSS attack to steal the cookie of the admin o i can login with that cookie

but do i need to have backtrack to listen on the port 80 or am i totally wrong now??

18replies
7voices
501views
Mugi [Mugiwara27]
9 years ago

0

You just need to make your internet connection work that’s all

BitSec01
9 years ago

0

But do i need to make the cookie visible after the admin viewed it? or send it to myself or make a cookie using javascipt??

Mugi [Mugiwara27]
9 years ago

0

Think a little you got the vulnerability, what to do with that one ?
What can you do to steal the admin account?

BitSec01
9 years ago | edited 9 years ago

0

so i have come up with this code:

–removed spoiler

and the php file will save the cookie data but how long will it take before an admin sees my comment?
and is this a good exploit/attack or do i have tty in an other direction?

Mugi [Mugiwara27]
9 years ago

0

First can you remove that spoil please ?
And yes you need to use that type of injection
But you need to understand something else to make your injection works
It will take maximum 10 minutes to the admin to see your code

BitSec01
9 years ago | edited 9 years ago

0

where do i need to look to understand it.

Mugi [Mugiwara27]
9 years ago

0

Yes ( then remove that spoil, PM’d you ;) )

BitSec01
9 years ago

0

Any tips on how to break the character limit ??

dloser
9 years ago

0

Hey, here’s an idea: try to figure something out on your own!

BitSec01
9 years ago

0

i dont know where to look and i`ve been searching for hours now but i do not know how to break the character limit and when i try to google it only shows how to put a character limit on the textarea

dloser
9 years ago

0

Be creative. And if you don’t get it now.. just leave it for a while.

2 replies have been removed

0

@SkyRamon: As @dloser said, you don’t need to solve these challenges in one turn. Sometimes people need time to learn more, to acknowledge what they have read or just to self-reflect.

BitSec01
9 years ago

0

freewind1012 i cant stop thinking about this level. Its some sort of addiction. I have to finish this so can people give me some nice links that can lead me to the solution ?

BitSec01
9 years ago

1

i think i found it can i make it inside a img ? because thats shorter then script tags. and use a src to get the script.

tl0tr
9 years ago

0

@SkyRamon : I think that should work. See you on the Solution thread.

BitSec01
9 years ago

0

Okay xD now i just need to get back home from school to test it..

BitSec01
9 years ago

0

why is the image not showing? i tried to shorten the url and put it in the source so an image is viewed and then i know its being excuted.

<img src="is.gd/3Gn8Tv"/>

Mugi [Mugiwara27]
9 years ago

0

Sky did you read what I’ve said in PM ? –"

2 replies have been removed
You must be logged in to reply to this discussion. Login
1 of 19

This site only uses cookies that are essential for the functionality of this website. Cookies are not used for tracking or marketing purposes.

By using our site, you acknowledge that you have read and understand our Privacy Policy, and Terms of Service.

Dismiss