Pwning with XSS: from alert() to reverse shell: Defcon Banglore 2013
Download as PPTX, PDF5 likes10,321 views
This document discusses using a web shell proxy to serve malicious JavaScript files to victims attempting to access legitimate sites like Facebook.com, exploiting cross-site scripting (XSS) vulnerabilities without the need to directly hack the target sites' servers. The proxy intercepts requests and responds with payloads that can then attack the victims.
1 of 6
Downloaded 184 times
Pwning with XSS: from alert() to reverse shell: Defcon Banglore 2013
- 2. • • • •
- 3. START
- 4. Xenotix HTTP Web Shell Proxy Web Server ATTACKER VICTIM GET http://facebook.com Serve the JavaScript File Facebook.com HTML page contents FB’s Server
- 5. SO.... Never Under Estimate the Power of XSS