And the infected person adds you that

CIS 544

Professor: Anys Bacha

2.Methodology and Result

Task 1: Posting a Malicious Message to Display an Alert Window

Code：<script>alert(’XSS’);</script>

We can do this by having the malicious JavaScript insert an Error! Filename not specified.tag with its SRC attribute set to the attacker’s machine. When the JavaScript inserts the Img tag, the browser tries to load the image from the URL in the SRC field; this results in an HTTP GET request sent to the attacker’s machine. The JavaScript given below sends the cookies to the port 5555 of the attacker’s machine (with IP address 10.1.2.5), where the attacker has a TCP server listening to the same port.

In this experiment, I have taken advantage of the vulnerability on the website to carry out XSS attack on the modified Elgg. The ultimate goal of this attack is to spread the XSS worm among users so that anyone viewing an infected user's profile becomes infected, and the infected person adds you (that is, the attacker) to his/her list of friends. Using this malicious code, an attacker can steal a victim's credentials, such as cookies.