Basic XSS understanding

Hello guys,
today I'm going to try to give you my basic understanding of XSS attacks.
there are two types of XSS attacks which are

1. None Persistent XSS

2. Persistent XSS



First, the None Persistent one is when you add your text like this:

www.website.com/search.php?search=Troll3d 

and the site shows something like:

"Search Result For Troll3d"


when we see that the text is displayed on the page with no validation 

then we try to put some HTML tags like:

www.website.co,/search.php?search=Tr0ll3d

or some Javascript like:

www.website.com/search.php?search=<script>alert("Tr0ll3d");</script>
If we got blinking text, or the java script ran successfully that means we can display anything we want, but that's not that dangerous for the website.

Second type is the Persistent XSS, this one is more dangerous which allow us to inject our codes in the website's source, with just little knowledge of Javascript you can even deface the website at extreme cases.
For the Persistent XSS, I found a perfect video from OWASP tutorials which I learned XSS from (Today after I got a request to make this tut xD )

Hope it was useful  for you guys :)
enjoy

Read More

Tips To Improve Backtrack

Hello everyone
as many people say "backtrack is hard to use" or "backtrack is not for daily use", but today I'm going to give you some tips to make backtrack perfect for your daily use, even KDE (which is harder to use than GNOME )



1. To make software installing much much easier and easier to search for a software Run this command:


apt-get install software-center

This command will install "Ubuntu Software Center" where you can search for software and install them with just one click


2. To install the best messengers in linux run this command:



apt-get install empathy && apt-get install pidgin

with those two you can connect and chat with yahoo, MSN, facebook, jabber (like nimbuzz, and mig33), and much more! and I would install them both and try to see which one is the best for my use.  but those two are my personal best xP



3. For screen Recording install XVidCap by running this command:


apt-get install xvidcap

This one has good quality I used it couple of times and liked it


4. TeamViwer, it can be downloaded from teamviewer.com.. and then installed with the following commands:


root@bt:~# cd Downloads

root@bt:~/Downloads# dpkg -i teamviewer_linux*.deb



5. For archive extraction (ALMOST ALL TYPES) install ARK but running this command:


apt-get install ark

I really like it, .rar, .zip, .tar, etc etc it can extract them !
you can also install "unrar" and "zip" by running the commands bellow:


apt-get install zip
apt-get install unrar



6. Installing VLC, which i failed in when i first used backtrack
but its the only player which can play .avi and .mpeg ... anyways
here is a video tutorial on how to install it and make it run as root (tut made by me xP)


How To Run VLC As Root



7. and now  google chrome my fav browser  which cant be opened as root  but here is a tut on how to fix this error and make it run as root and run smoothly


How To Run Google Chrome As Root

tut made by me as well xP



8. FTP client for linux, my personal best.. filezilla run the command bellow:


apt-get install filezilla



9. Now this one is for personal use  Offic package just like microsoft word and powerpoint.. but the open source version lol.. run the command bellow:


apt-get install openoffice.org

this command will install the whole package..



10. PDF reader, thats if it was not installed already run this command:


apt-get install xpdf



11. To install windows based programs "no all, just the most important" we will get "winetricks" which is now available in GUI version.. to make it read to use run these commands:


root@bt:~# wget http://winetricks.org/winetricks
root@bt:~# chmod +x winetricks

and then to use it just open the terminal and type:

root@bt:~# ./winetricks
(make sure that its in the same dir as you are by running the command "ls" to check if it was there)



12. to run VB .NET programs you have two options (do them both just to be sure )
installing "mono" by running this command:


apt-get install mono-complete
(mono is also used as for development not only running programs)
to run a program using mono type this:


mono PROGRAM-NAME.exe

(be sure to make the program executable using the following command:


chmod +x PROGRAM-NAME.exe

IF MONO DIDNT WORK, we have another option which is installing .NET framework using "winetricks"
open terminal, enter the dir that has winetricks and then run this command:


./winetricks corefonts dotnet20

after its done all you have to do is right click on the program you want and then choose "open with wine windows program loader" from the menu

now finally just update and upgrade your system by running this command:


apt-get update && apt-get upgrade && apt-get moo


that's it
enjoy using backtrack now :)

Read More