XSS Vulnerability Question

[PiZZ4]

I'm sort of a noob when it comes to XSS vulnerabilities, so here is a noob question:

Lets say if you have found a xss vulnerability on a website, what can you do with it?

[Kulverstukas]

I guess nothing. Unless it's an persistent one.

[Satori]

I guess nothing. Unless it's an persistent one.

And this isnt true.
You could make a cookie grabber and send the xxs vulnerable link to victims for example.

[ca0s]

You can do whatever you want. Exploit a browser bug, steal credentials, use browsers as zombies.
If is persistent, so much easier. If not, also exploitable (more likely targeted attacks).
For an example, look for the Beef framework.

[gh0st]

you can steal the credentials of some1 if he/she clicks the link or visit the exploit
http://www.youtube.com/watch?v=WZCXIrW0xZ0
http://www.youtube.com/watch?v=JBpG2fie_aA&feature=related
thanx to infinity exists
I know a bit the teory but Ive never done it before

[FuyuKitsune]

Insert Javascript to the page. Sometimes it's a bit difficult with the filters, basic PHP filters may require some code maneuvering, but it's easy enough to run Javascript or link to a JS file. Last time I did an XSS I did JS to change the background image to a dancing banana.

[PiZZ4]

You can do whatever you want. Exploit a browser bug, steal credentials, use browsers as zombies.
If is persistent, so much easier. If not, also exploitable (more likely targeted attacks).
For an example, look for the Beef framework.

It's defiantly persistent, I've double checked just to make sure it was.

[/quote]Insert Javascript to the page. Sometimes it's a bit difficult with the filters, basic PHP filters may require some code maneuvering, but it's easy enough to run Javascript or link to a JS file. Last time I did an XSS I did JS to change the background image to a dancing banana.[/quote]

Now that is interesting, I guess I'll have to look into that.

[FuyuKitsune]

Now that is interesting, I guess I'll have to look into that.

It has to be a .js file. I spend a long time screwing up because I was trying to run .txt extensions and extensionless files in HTML.

[iMorg]

Session Hijacking.

[ande]

Session Hijacking.

That would be the same as cookie grabbing.

[noob]

Code: [Select]

http://rapidshare.com/files/129854305/www_GoonWarez_com_1213375552.zip