Deep Look At Netdevilz XSS : Whois.com Hacked

These days xss and sql injection and mostly blind sql injections are working allot as we have also covered many of them like the Intel one, and many others too but this time the big domain tool whois.com is hacked.

 

 

Well i am not sure that many of you guys won't know what is whois, so here is the basic information about it.

 

WHOIS (pronounced as the phrase who is) is a query/response protocol that is widely used for querying databases in order to determine the registrant or assignee of Internet resources, such as a domain name, an IP address block, or an autonomous system number. ~ via Wiki

 

The WHOIS system originated as a method for system administrators to obtain contact information for IP address assignments or domain name administrators So, the end of the story tells that it is useful…

 

The Website was hacked about 1 to 2 days ago, by any hacker named Netdevil as of till now the hacker is pretty good in it as he have also previously hacked photobucket.com, which is another pretty popular photo sharing website, back in 2008.

 

This Turkish hacker have also Hacked ICANN website back also and have stricked again now in 2010 attacking Whois.com. Well i am not sure about it but some guys are saying that Netdevilz have also Hacked xiana.com and xssed.com before.

Screen Shots

 

 

 

*Click to view Full Size

 

XSS

Well until now you would be sure that Netdevilz used the XSS vulnerability in the web form to attack the website and hack the whole domain or you can say Full Ownage. The attack is a kind of clever and is my favorite XSS, A poisoned whois xD

 

If you look at the screenshot above of the xss, you would find the attacker script have been initialized the vector on the name of the form ..

 

http://domains.whois.com/domain.php?action=check_availability&goto=metarefresh&formaction=%22%3E%3Cscript%3Ealert(String.fromCharCode(88,83,83))%3C/script%3E

 

Well the &formaction is a kind of vulnerable to XSS and is hence attacked, i would like to thanks Security-Shell for this information of the XSS initializer and looking at the xss in the website.

 

Conclusion

Try it, if this works then awesome or it might be fixed till yet Enjoy this little hack, if you guy would like to learn more about xss hacking then you can see the
Basic XSS hacking article on the blog.

 

Thanks to d3v1l from Security-Shell For this information about the xss.

 

Happy Hacking @hackerthedude

Read More

2 New Interesting Xss This Week

This Week some of the genius hackers have found some really cool XSS vectors and which i want to introduce to you. These are some which are currently Unpatched and are Hot to use.

 

 

Lets see if you guys like them, these are basically good ones and would be useful to you. as i have tested them on some browsers and was found to be working when they were released...

 

IE8 XSS Filter Distorting Facebook

The First one is from Michael Coates, he have written this Facebook Xss in his blog post which is based on IE8, and which is currently Unpatched too. A Hacker can Code a malicious link and send this to the Victim.

 

He also said this haven't been disabled by the facebook security guys and is prone to attack. This provided a great example on the effects of the IE8 XSS filter. He have also written in his previous post about this attack.

 

 

 

He also have given this screenshot for the demo of the attack and the malicious Link :

http://www.facebook.com/search/?ref=search&q=IE8%3Cscript%3E&init=quick

 

 

Google Maps XSS

Discovered by two Indians this vulnerability hit the charts on twitter and was awesome, based on the Google Maps. Pratul Agrawal, Gaurav Baruah were the two authors.

 

 

The Xss is a Simple PoC right now and as per the two authors is currently Unpatched . You should check it out!

 

http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=%3Cscript%3Ealert(%22Google%20Sucks%20!%22)%3C/script%3E&vps=1&sll=28.613554,77.20906&sspn=0.009136,0.013797&ie=UTF8

 

 

Happy Hacking @hackerthedude

Read More