IEFD Ep. 21 - XSS Tunnel - Part 3 of 3

XSS Shell is a cross-site scripting backdoor into the victim's browser which enables an attacker to issue commands and receive responses. During a normal XSS attack an attacker only has one chance to control a victim's browser; however, the XSS Shell keeps the connection between the attacker and the victim open to allow the attacker to continuously manipulate the victim's browser. XSS Shell works by setting up an XSS Channel, an AJAX application embedded into the victim's browser, that can obtain commands and send back responses. To enable the XSS Shell an attacker needs to inject the XSS Shell's Javascript reference by utilizing a XSS flaw on a website. Once the victim's browser is infected with the XSS Shell and the XSS Channel is created, the attacker can issue instructions to the infected browser. Also, the Attacker can use a XSS Tunnel to transfer HTTP traffic through the XSS Channel and the victim's browser; in turn, exploiting the victim's credentials to bypass authentications and IP Restrictions. The XSS Tunnel is a HTTP Proxy that sits on an attacker's computer, and any tool that is configured to use it will tunnel its traffic through the XSS Channel.

Part 3 of 3

www.InfinityExists.com

Category:

Howto & Style

Tags:

• Infinity
• Exists
• XSS
• Cross
• site
• scripting
• website
• hacking

[Backstaberxx1]

Awesome! There is a lack of good hackers :)

[flix369]

heyy guyz- your XSS vidz are brilliant- really useful. ty n tc.

[lu1chy]

How come you guys don't use my screen recorder and play the video on your pc - then post it on youtube- that's how I get my HQ vids up 720p and 1080p ( I think it's 1080p) or Cam Studio or Sony Vegas? I'm sure you know all about them - just wondering tho?

[N1c062]

J'ai bien tout fait mais quand je clique sur une commande rien ne se passe :/ si quelqu'un a la solution ...

[verycrazyghoul]

Thanks for another good tutorial.

This is very powerfull shit. Once i tryed to configure shell xss, but didn't find any help how to do it...

I luv ya ;) Good job guys. Keep it up.

[ipen5]

this reminds me a lot about botnets. am scripting one right now for my server. takes a long time.

[Xperenty]

nice vid!

what kind of laptop do you use?

[Senseij14]

cool dudes, thanks for sharing!