Hack Security Pro.pdf - Index of

To trap his victim more easily, the hacker has encoded the url using a small script like this one:
This is what the victim will see with his client email interpreting the HTML:
When the victim clicks on the link, he will be redirected to his trusted website, i.e.
www.hackerbank.com. If ever he identifies himself, the hacker will recover his login / password.
We have just seen how to use an XSS. XSS are also used to recover the value of a cookie which
generally contains the login/pass of a client or a session number. To do this, the hacker will use
javascript, the language executed on the client side. A cookie is generally created when a client gives
his identification on a website to avoid having him give his identification over and over again each time
he changes pages. That is because the value of a cookie is sent in every packet that the navigator
emits to a domain having created a cookie on the client's computer. So, if for example the hacker
wants to recover a victim's cookie to log in his place to www.hackerbank.com, he will at first have to
redirect the client to hackerbank.com and make him execute javascript that will recover the value of the
cookie if he does not find it in the domain he has created.
To illustrate this example, we are going to imagine that the client has logged on to the server
www.hackerbank.com and that the domain has just created a cookie with the user's login/pass. Here is
a small PHP script which creates a cookie and that is vulnerable to the same XSS as previously:
The Hackademy DMP -132/209- SYSDREAM