http://youtu.be/-W3efiMT8H0
Sample web page to test Javascipts in browser. Save the following code in a text file, name it test.html ad open it in your browser to see what it does.
<HTML>
<HEAD>>
<script> window.open('http://zoltandfw.blogspot.com/','_blank')</script>
<script> alert(document.cookie)</script>
<script> alert("Your account has been compromised, please call (111)222-3333 to report!!!") </script>
</HEAD>
<BODY>
Just a test for JavaScripts
</BODY>
</HTML>
Sample log file entries showing details on what information might be collected in log files to investigate after the fact or monitor for real-time response.
141027 7:39:45 122 Connect root@localhost on
122 Init DB badbank
122 Query SELECT userid, accountnumber FROM badbank_accounts WHERE username='zoltan' AND password='9f1c050c2b226c2154d17a3ff9a602f6'
122 Quit
141027 7:41:55 123 Connect root@localhost on
123 Init DB badbank
123 Query SELECT userid, accountnumber FROM badbank_accounts WHERE username='zoltan' -- ' AND password='d41d8cd98f00b204e9800998ecf8427e'
123 Quit
141027 8:00:30 124 Connect root@localhost on
124 Init DB badbank
124 Quit
125 Connect root@localhost on
125 Init DB badbank
125 Quit
141027 8:42:47 126 Connect ODBC@localhost as on
126 Query select @@version_comment limit 1
141027 8:42:55 126 Query show databases
141027 8:43:26 126 Query SELECT DATABASE()
126 Init DB Access denied for user ''@'localhost' to database 'badbank'
141027 8:43:41 126 Quit
...
141027 9:04:20 130 Query select * from badbank_transactions
141027 9:05:22 213 Connect root@localhost on
213 Init DB badbank
213 Query SELECT balance FROM badbank_accounts WHERE userid=61
213 Quit
141027 9:05:37 214 Connect root@localhost on
214 Init DB badbank
214 Query SELECT balance FROM badbank_accounts WHERE userid=61
214 Query SELECT userid FROM badbank_accounts WHERE username='victim1'
214 Query UPDATE badbank_accounts SET balance=balance-1 WHERE userid=61
214 Query UPDATE badbank_accounts SET balance=balance+1 WHERE userid=60
214 Query INSERT INTO badbank_transactions (userid,time,withdrawn,transactor,transfernote) VALUES (61,NOW(),1,60,'<script> alert(document.cookie)</script>')
214 Query INSERT INTO badbank_transactions (userid,time,deposited,transactor,transfernote) VALUES (60,NOW(),1,61,'<script> alert(document.cookie)</script>')
214 Quit
141027 9:05:41 215 Connect root@localhost on
215 Init DB badbank
215 Quit
216 Connect root@localhost on
216 Init DB badbank
216 Quit
No comments:
Post a Comment