Detecting and Exploiting XSS Injections using XSSer Tool

http://securityxploded.com/detecting-exploiting-xss-using-xsser-tool.php

 Detecting and Exploiting XSS Injections using XSSer ToolAuthor:Manjunath aka Punter    See Also 

Index of all Anti-Spyware Tools
Index of all Password Secrets Articles
Nexpose + Metasploit = Shell
DllHijackAuditor: Smart tool to Audit DLL Hijack Vulnerability
SXPasswordSuite: A Complete Password Recovery Toolset
Research Article: 'Password Secrets of Popular Windows Applications'
SpyDLLRemover: Detect & Delete Spy DLLs from the system.
StreamArmor: Advanced tool to Scan & Sweep Malicious Streams.
Recover Windows password in seconds using Rainbow crack.

   Contents 

• About XSSer Tool
• In action with XSSer
• XSSer Action Screenshots
• Exploitation of XSS Injections
• Conclusion
• References
  

  About XSSer Tool  XSSer [Reference 1] is an open source penetration testing tool that automates the process of detecting and exploiting XSS injections  in any website.

In this introductory article I will show you how easy to use the XSSer for Detection and Exploitation of XSS in a vulnerable website.   In action with XSSer Here we will experiment this tool on following test vulnerable website, http://testasp.vulnweb.com/

Below are simple steps on using XSSer.  root@punter:/pentest/web# $ svn co https://xsser.svn.sourceforge.net/svnroot/xsser xsser

root@punter:/pentest/web# cd xsser

root@punter:/pentest/web/xsser# python XSSer.py -u 'http://testasp.vulnweb.com' -g 'Search.asp?tfSearch='
-proxy 'http://127.0.0.1:8118? -referer '666.666.666.666? -user-agent 'correct audit' -Fuzz -s   XSSer Action Screenshots After you execute above sequence of commands you can see the results as shown in the sequence of screenshots below. Screenshot 1:  Testing the vulnerable website for XSS Injections using XSSer   Screenshot 2:  Testing the vulnerable website for XSS Injections using XSSer [Continued]   Screenshot 3:  Final results of XSS Detection operation. You can see that XSSer has already found couple of XSS flaws in our test website.    Exploitation of XSS Injections In the above screenshot, the text marked in blue indicates attack vector which can trigger XSS Injectionson this website. 

Now we can go ahead and manually verfy these injections and it does not take long. 

Below is the screenshot showing successful exploitation of detected XSS Injection.    Conclusion This article shows how easy to use XSSer tool to detect those hiddenXSS flaws in any website using very simple steps. You can rest your brain for the time being while XSSer does all the job for you.   References 

• XSSer - Open Source based XSS Injection Detector Tool