Dvbbs and other forums exist cookies steal loopholes

Source: Internet
Author: User
The honor of irrigation company produced
◇ This vulnerability involves the version::
Dvbbs, discus all versions, other forums have not been tested, believe that most of the vulnerability exists
◇ Description:
As Dvbbs and other forums on the Flash play form, resulting in the attacker can use flash embed a section of JavaScript code, to steal the user's cookies
◇ Specific analysis and utilization:
1. First prepare a space to run ASP to store cookies
2. Create a new Flash animation, add the following code:
Onclipevent (load) {
Url= "Javascript:var rng=document.selection.createrange (); rng.pastehtml (" <iframe name=frame_hide style= ' Display : None ' ></iframe> ");"
GetURL (URL);
}
The use of IFRAME is to allow others to find the program's page jump
3. Export FLASH as a SWF file, insert into the forum where you want to steal cookies, add code [Flash=0,0]http://flash address [/flash] (note, some forums are [swf][/swf])
4. In this way, if a user enters the post, the JavaScript program will send the user's cookies to writecookies.asp and save them to the database
5. As for the cookie cheat, recommend to use IECookiesView, many tutorials have introduced, here is not much to say
◇ Remark
1. For the forum to disable flash, you can also use the PNG format image embedded code to steal
2. After the cookie, the password is the MD5 algorithm encrypted string, if you like to use violence, you can try to decode, of course, the individual is not recommended this method
◇ Solution:
1. Disable flash, or change flash to link format, to move the network as an example, modify the inc/ubbcode.asp file
Find the following two paragraphs
Re. Pattern= "([FLASH]) (. [ ^[]*) ([/flash]) "
Strcontent= Re. Replace (strcontent, "<a href=" "$" "Target=_blank>[Full Screen appreciation]</a>
<object codebase=http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=4,0,2,0 classid= clsid:d27cdb6e-ae6d-11cf-96b8-444553540000 width=500 height=400><param Name=movie value= "" $ "" ><PARAM Name=quality value=high><embed src= "" $ "" Quality=high pluginspage= ' http://www.macromedia.com/shockwave/ Download/index.cgi? P1_prod_version=shockwaveflash ' type= ' Application/x-shockwave-flash ' width=500 height=400>$2</embed>< /object> ")

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.