Extending XSS to upload Shell in a Website By Pentester708

[58]

XSS is much like SQL Injection , it is Javascript Injection(Pretty much straight eh for the newbies)

Now instead of uploading some Phishing , CSRF payloads . I Injected an uploader.php in here.
The site was not having any upload feature previously but after i injected the payload, Anyone can upload anything(exe,php,bat,what not) to it, which will be stored and executed on the Server Level.

I wonder what would you guys have uploaded ?

Well I did the harder part for yal. Play around uploading your shells
m,,,,,,,,,,,,lkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk


jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj
You can get to your uploaded shells by adding its name in the URL after uploading


Site:

mmmmmmmmmmmmmmm......lmmmmmmmmmmmmmmmmmmmmmmm

[31]

XSS is much like SQL Injection , it is Javascript Injection(Pretty much straight eh for the newbies)

Now instead of uploading some Phishing , CSRF payloads . I Injected an uploader.php in here.
The site was not having any upload feature previously but after i injected the payload, Anyone can upload anything(exe,php,bat,what not) to it, which will be stored and executed on the Server Level.

I wonder what would you guys have uploaded ?

Well I did the harder part for yal. Play around uploading your shells

You can get to your uploaded shells by adding its name in the URL after uploading


Site:

thats very creative, never thought of it

[37]

wow, grea8

[27]

thenks...

[193]

lets check it
great job thumbs up

[7]

[font][font]Nice!!![/font][/font]

[59]

Thank you very much

[20]

[shoppy][/shoppy]