Re: Exploiting XSS

[NeZa <danuxx () gmail com>]

Scenario 1: Phishing

You also can do phishing by preparing your faked page identical to the
original one, customers got shocked after seeing this.
And it is more powerful than normal phishing because the faked page is
shown in the same web site.

My two cents!!!!!

On Wed, Dec 3, 2008 at 2:01 PM, Baykal, Adnan (CSCIC)
<adnan.baykal () cscic state ny us> wrote:
> One thing quick is to use the XSS to steal visitor cookies and
> sessionids then do session hijacking. Or use jitko to scan internal
> systems. Also grossman described this approach recently.
>
>
>
> --------------------------------------------------------
>
> This message may contain confidential information and is intended only for the individual(s) named.  If you are not 
> an intended recipient you are not authorized to disseminate, distribute or copy this e-mail.  Please notify the 
> sender immediately if you have received this e-mail by mistake and delete this e-mail from your system.
> -----Original Message-----
>
> From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
> On Behalf Of Whitehat
> Sent: Wednesday, December 03, 2008 12:09 AM
> To: pen-test
> Subject: Exploiting XSS
>
> Dear List,
>
> I'm doing a WAPT for a website and found many XSS issues (both Stored
> and Reflected).
> I wanted to do more and show to the customer, apart from normal script
> injection  and  getting it popped up.
>
> Consider that u found an XSS issue in a field and your script is
> running,
>
>   1. Now what are the further steps for exploiting XSS completely????
>   2. How an attacker can really make  use of  it?
>   3. How to Compromise ??
>   4. What are the real world scenarios can be used
>
> Looking for few good inputs/imlementations/expolits/BooKs ..............
>
> Thanks in advance,
>
> Cheers,
> White hat
>
>
> ------------------------------------------------------------------------
> This list is sponsored by: Cenzic
>
> Security Trends Report from Cenzic
> Stay Ahead of the Hacker Curve!
> Get the latest Q2 2008 Trends Report now
>
> www.cenzic.com/landing/trends-report
> ------------------------------------------------------------------------
>
>
> ------------------------------------------------------------------------
> This list is sponsored by: Cenzic
>
> Security Trends Report from Cenzic
> Stay Ahead of the Hacker Curve!
> Get the latest Q2 2008 Trends Report now
>
> www.cenzic.com/landing/trends-report
> ------------------------------------------------------------------------



-- 
Daniel Regalado aka NeZa
Hacker Wanna Be from Nezahualcoyotl

www.macula-group.com

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------