WHERE TO START

[usernamenotused]

I have already wrote a topic on this thread, but obvously it was too spoilery. guess that i was trying to help the noobs a bit too much sorry fellas, now, i have got some people asking me what to do, . . . i say that this small hint might be enough for those of you looking for a way to go, without being a spoiler. when you have user information kept in cookies, you can view them using

Code: Select all

javascript:alert(document.cookies)

Now, you want to log in as the administrator, (rconnor's boss) and access the pay page. so, you need to change the information in the cookie from rconnor's login information, to his bosses. who stole the cookies from the cookie jar? well it better be you if you want to finish this realistic mish. 3 things here. 1. google is your buddy, 2. freakwolfe is pretty good at stealing cookies from the cookie jar. 3. xss is your other buddy.

[sk8linkinhr]

nice tutorial

[Robbinski12]

actually it's

Code: Select all

javascript:alert(document.cookie)

[Damascus2k8]

actually it's

Code: Select all

javascript:alert(document.cookie)

or it could be

Code: Select all

solved=download(FF & Add 'n' Edit Cookies)

[tehMurloc]

I'm stuck =(

Might contain spoilers

I have successfully created a working cookie stealer (I tested it), but the problem is that I don't know how to use it. I think the point is to make the boss somehow visit the stealer site, but I'm not sure how to do that . I tried some techniques of sending some scripted mails, but I couldn't make it. I'm not sure if that is the right way, so some advice would be useful.
Thanks!

[purple_pixie]

When you tested it, did you test it with the JS to call the stealer, or just straight visiting the .php ?

[tehMurloc]

When you tested it, did you test it with the JS to call the stealer, or just straight visiting the .php ?

Yes, I used JS to call it.

[c24lightning]

When you tested it, did you test it with the JS to call the stealer, or just straight visiting the .php ?

Yes, I used JS to call it.

Are your variables correctly set up? Do you include the cookie(s) at the end of the URL using JS?

[pescador]

I think I have the same problem as tehMurloc. When I call my script I receive my own cookie, so that seems to work. Now when I send it to a certain someone, nothing happens. Also, when I try to send a message to myself (I mean r-conner), I don't receive anything. Is that correct?

[robi_petranovic]

I think I have the same problem as tehMurloc. When I call my script I receive my own cookie, so that seems to work. Now when I send it to a certain someone, nothing happens. Also, when I try to send a message to myself (I mean r-conner), I don't receive anything. Is that correct?

yeah,same thing with me.... And I have tested it with my own cookies and it works....