|
Brought to you by:
Suppliers of:
|
|
|
| |
Credit:
The information has been provided by Ferruh Mavituna.
To keep updated with the tool visit the project's homepage at: http://ferruh.mavituna.com/article/?1338
|
| |
XSS Shell is powerful a XSS backdoor and zombie manager. This concept first presented by XSS-Proxy. Normally in XSS attacks attacker has one shot, in XSS Shell you can interactively send requests and get responses from victim. you can backdoor the page.
You can steal basic authentication, you can bypass IP restrictions in administration panels, you can DDoS some systems with a permanent XSS vulnerability etc. Attack possibilities are limited with ideas. Basically this tool demonstrates that you can do more with XSS.
XSS Shell has several features to gain whole access over victim. Also you can simply add your own commands.
Most of the features can enable or disabled from configuration or can be tweaked from source code.
The main feature in XSS Shell is 'Page Regeneration'. XSS Shell re-renders the infected page and keep user in virtual environment. Thus even user click any links in the infected page he or she will be still under control! (within cross-domain restrictions) In normal XSS attacks when user leaves the page you can't do anything. Secondly this feature keeps the session open so even victim follow an outside link from infected page session is not going to timeout and you will be still in charge.
Other features:
* Keylogger
* Mouse Logger (click points + current DOM)
Built-in Commands:
* Get Keylogger Data
* Get Current Page (Current rendered DOM / like screenshot)
* Get Cookie
* Execute supplied javaScript (eval)
* Get Clipboard (IE only)
* Get internal IP address (Firefox + JVM only)
* Check victim's visited URL history
* DDoS
* Force to Crash victim's browser
|
| Subject:
|
Jet Errors |
Date: |
16 Sep. 2008 |
| From: |
s.shahemail.com |
Hi I get the following error when running the XSS shell on a ASP hosting server (http://free.7host05.com/..../XSS/..)
Microsoft JET Database Engine error '80004005'
'E:\user1\andytodd\db\shell.mdb' is not a valid path. Make sure that the path name is spelled correctly and that you are connected to the server on which the file resides.
/andytodd/XSS/SHELL/admin/fmlibrary/fmlibraryv3.asp, line 192
1. I have set db.asp DBPATH=E:\user1\andytodd\db\shell.mdb
2. I have set default.asp to include <script src="e;http://free.7host05.com/andytodd/XSS/SHELL/xssshell.asp"e;></script>
3. I have set xssshell SERVER=http://free.7host05.com/andytodd/
what else do I need to do, as I feel it has been set with the correct parameters????Thanks???? |
|
| Subject:
|
Randomness!!! |
Date: |
30 Jan. 2010 |
| From: |
Anonymous |
| I really like XSS Shell. Its <b>AWESOME</b></ for port scanning. |
|
|
|
|
|
|
