Hmm there are plenty of sites out there to learn about XSS and
SQL injection. But the issue here is about finding a vulnerability
on a website that, say, that will allow you to post unencoded HTML.
So to grab cookie contents, you would probably write something
like:
So for example, if you could plant this code into a forum post, as
"raw" HTML, everytime the post is loaded, the browser will attempt
to load a 0 pixel by 0 pixel (aka unseen) image using the URL which
is embedded with the user's cookie information. And on the other
side, when the "image", which is a script, receives the request, it
ignores it and does something like storing the cookie information
that was passed to it through the URL.
But most scripts around filters all these HTML tags from user input
so it is quite pointless unless you really have so much free time
going around to try this out on different websites.
If you are really interested, you can read on the technical
explanation of the infamous MySpace worm, aka Samy Worm. It does
not need to steal cookie - it uses the victim's computer to do what
the coder wanted. Also, another reason why you are less safe using
IE than other browsers - under Step 1, "However, some browsers (IE,
some versions of Safari, others) allow javascript within CSS tags.
We needed javascript to get any of this to even work".
http://namb.la/popular/tech.html
