Cross Site Scripting (XSS) #XSS #Infosec #Vulnerability #Pentesting #Hacking #Website #Defacing

It is a vulnerability found in websites which allows an malicious attack/cracker to inject client-side scripts into the web pages. By using this vulnerability an attaker can deface a website, redirection attacks can be done and session cookie stealing is also possible by exploiting this vulnerability.
There are two types of XSS vulnerability found in web applications.
1. Non-persistent
2. Persistent

Non-persistent
Non-persistent type of XSS vulnerability is the most common one. Non-persistent XSS happens when a malicious HTML query is done by an attacker and that query is used immediately by the server-side to generate the page result.

Persistent
Persistent type of XSS vulnerability is a dangerous kind of vulnerability. This happens when a malicious HTML query is done by the attacker and that query is immediately saved by the server and is permanently displayed on the normal pages. 
In this tutorial we're going to learn how to deface a XSS vulnerable site via Non-persistent XSS vulnerability.

In order to find sites vulnerable to XSS use Google dorks. The most common Google dork used by attackers to exploit the XSS vulnerability is: inurl:search.php?q=

How to find if the website is XSS vulnerable or not. Example Website: "www.website.com/search.php?q="
Open the website, you will find a search box. in that search box type this code: <script>alert("XSS Detected !!")</script>

And click on search. If the site is vulnerable, you will get a Jquery box saying "XSS Detected", if you got that you can move forward to deface the website site. Now if you want just to display a simple message like
"H4CK3D", Enter the below HTML code and click on search. <h1><center><b>Hacked by RY44ND4V15</h1></center></b>

Mozilla Recovery - crack master passwords #Passwords #Mozilla #Firefox

About the program
Requirements: Java 7 or a higher version



Once you start the program, it searches automatically for default locations of your key3.db in Firefox and, if not found, in the Thunderbird application directory. I prepared and tested this for Windows 7 and Linux. If it is not working for your OS, please tell me the default location for it. I just need the information to put that in. You can change the location by hand, of course.

key3.db is the file that is used to recover the master password. You can start a wordlist attack on that. The program ships with a default worldlist, but it is small (I didn't want to upload a wordlist file that adds several megabytes to the program). You can use your own list by changing the location.

Alternatively you can start a bruteforce attack by activating the "bruteforce" checkbox. Although I used threads, this is limited to a word length of five (a bruteforce attack with a wordlength of six would take several days, so I don't allow that) and the alphabet a-zA-Z by now. I got about 30000 password tests per second on my machine.

Once you got the master password, it is very easy to obtain saved login information from signons.sqlite, since both, Thunderbird and Firefox, will show usernames and passwords in plain text. (google if you don't know how)

Conclusion: Always set a master password if you save login information with Thunderbird or Firefox. Otherwise the login information can be obtained without any problems.

 

About the source

The only (non-standard) library I used is apache.log4j for logging purposes. You will see a properties file and a log folder. The standard logging level is WARN. If you change this level to INFO or DEBUG, the master passwords found with the program will be saved in there, so be careful with that option.

Lines of code without comments and empty lines: 914
Lines of code with everything else: 1141

The source is attached as Source.zip.

The code was tested for: Firefox 9.01 Thunderbird 9.01, Windows 7, Arch Linux
If you have a different setting, you can help me by telling me that it worked or that it didn't.
Edit: According to Kulverstukas and Superfly it works in Windows XP too. theellemist tested it on Windows Vista. Thanks to you.

Problems?

Please make sure that you have Java 7 or a higher version Mozilla Recovery.zip (471.23 kB -)
 Source.zip (452.76 kB -)

6 Useful #Websites to Learn #coding as a #Beginner to #Expert.

#1. w3schools -
W3schools is number 1 as it helps beginners to learn
code from A to Z.
All You need to do is just go to W3schools and select a tutorial of the language you want to learn, then
take a cup of coffee and start learning.
No skills required.
You will learn > HTML/ CSS (HTML5/CSS3), Javascript, PHP, ASP, XML, AJAX, jQuery





#2. Codecademy -
Codecademy is a best alternative to W3schools,. with Codecademy you can learn any language and start programming in a funny way.
No skill required.
You will learn > HTML/CSS, PHP, jQuery, JavaScript, Python, Ruby





#3. Code avengers
Same as Codecademy, Code avengers provides an easy to use platform and its a funny way to code and gain experience.It comes with 3 Levels that a user have to pass them to become a full expert. No Skills Required
You will learn > HTML/CSS (HTML5/CSS3), JavaScript





#4. CodeSchool -
Codeschool provides you a very easy to use interface, Design, and not much unwanted text.
No skills required.Language you will learn > HTML/CSS, Ruby on Rails, JavaScript, iOS





#5. TeamtreeHouse -
Teamtreehouse is very similar to Codeschool which provides you simple and easy way to learn Coding.
No skills required. Languages you.Will learn HTML/CSS, iOS,. Android, Wordpress





#6. Dreamincode -
Last one is Dreamincode, many developers and programmers have taken their knowledge from Dreamincode.  The only thing is the interface is a bit boring and plenty of text as well.
No skill required Languages you will learn> C++, Java, VB, VB.net, C#, PHP, ColdFusion,
Thats it, Try these Sites to enhance your coding knowledge, Very usefull For beginners.