Friday, 18 February 2011

How to Start with XSS Hacking ?

                   XSS vulnerabilities occur due to weak coding of the web applications. Once the hacker finds this vulnerability he/she injects malicious codes(Usually in web forms) to steal session cookies and later the hacker uses those cookies to gain access to sensitive page content.
Xss Cross Site Scripting may be classified in two types:
1.Persistent XSS
2.Non Persistent XSS
In order to demonstrate a XSS attack I will take an example of a website:

Checking the venerability
The simplest way to check the vulnerability is to enter the following code in the any web form present on the website
xss cross site scripting
Once the attacker inserts the code A dialog box like the below one will appear:

Now the attacker has found that the website is velnerable to an xss attack the attacker can do lots of damages to the website, The most common thing which the attacker will do is place his defacement image on that page showing that the website is hacked, For this purpose he will insert a code similar to the below one:
<html><body><IMG SRC=””></body></html>
Where is the defacement image
Inserting Flash Videos
The attacker can also insert flash videos by entering the following code in any web form present on the website
The attacker can also redirect the page to any particular page , In case if the hacker has managed to find XSS venerability in the a website like or he can redirect that page to a Phisher Site(Fake login page) where the victim will loose his password, To redirect a an xssed page to another page the attacker will insert a code similar to the below one:
<script> “” )</script>
Stealing Cookies
Most of the attackers after finding a website venerable to xss will probably steal victims cookies to gain access to their account or private data this method is called Session hijacking, which is a detailed topic and I will be explaining in the later articles :)
Hope you have learned some XSS ,Feel free to ask if you have any problem regarding the above information


Post a Comment

Related Posts Plugin for WordPress, Blogger...
Twitter Delicious Facebook Digg Stumbleupon Favorites More