Saturday, 27 December 2014

cross site tracing

Hey Folks, Let's Have a little look over Cross Site Tracing though many of you know as it is simple and easiest way but still for some of you who don't know what it is. M gonna Demonstrate.

Introduction

XST (Cross Site Tracing) is combined Attack that includes HTTP TRACE METHOD and XSS Techniques. XST Allows an Attacker to see what data is being recieved at the other end of the request chain. its an old attack type that was discovered in the late of 2003. well i think its enough for now, Let's move to practical as always UrduSecurity do.

Cross Site Tracing

Well Guys First of all I need a Web server to whom I've to send the request so for this im gonna use my Localhost on port 81. and Let's Try to access it via curl.
curl -X TRACE 192.168.1.3:81
ok now let's see what is in response.

cross site tracing 

Umph As we can see TRACE in response so this method is allowed. Now Let's try to Add a new header if we can do it by using curl's -H option.

cross site tracing

oh ?? injected :P , so this application is prone to xss attacks via Trace method that is inshort called Cross Site Tracing. If we don't see TRACE in response and see a source page then trace method is disabled.

Hope it's Clear.

Cross Site Tracing | WebAppSec

  • Uploaded by: Unknown
  • Views:
  • Category:
  • Share

    1 comments:

    1. CLASSIC CYBER HACKS
      How well are you prepared for a Cyber incident or Breach?, Is your Data safe?
      Strengthen your Cybersecurity stance by contacting CLASSIC CYBER NOTCH @ GMAIL DOT COM for a Perfect, Unique, Classic and Professional Job in Securing your Network against all sort of breaches and from scammers as well.
      For we are Specially equipped with the Best hands to getting your Cyber Hack needs met as your jobs will be handled with utmost professionalism.

      We do All type of cyber Jobs such as:
      ☑ TRACKING of GPS location, cars, Computers, Phones (Apple, windows and Android), e.t.c.
      We also Track
      E-MAIL account,(G-mail, Yahoo mail, AOL, Proton mail, etc.)
      SOCIAL MEDIA account, (Facebook, Twitter, Skype, Whatsapp, e.t.c.)

      ☑ RECOVERY of Passwords for E-mail address, Phones, Computers, Social media Accounts, Documents e.t.c

      ☑ INSTALLATION of Spy ware so as to spy into someone else's computer, phone or E-mail address and also Installation of Spy ware software on your individual O.S so as to detect intrusion of any type.
      We also Create and Install VIRUS into any desired computer gadget.

      ☑ CRACKING Websites, any desired gadget it computers or phones, CCTV Survelance camera, Data base (of both Private and Govt organization, such as Schools, Hospitals, Court houses, The FBI, NSA) e.t.c....

      NOTE:
      Other Jobs we do are:
      ☑ We provide Private Investigator service
      ☑ Clearing Criminal records of diverse type
      ☑ Binary Options fraud Recovery
      ☑ Bitcoin Mining
      ☑ Issuing of Blank ATM cards
      ☑ And many more... etc.

      We assure you that your Job will be attended to with care and efficiency as it will be handled by the Best professional hands in Cyber literacy.
      We also have a forum where you can get yourself equipped with Advanced hacking Knowledge..

      CLASSIC CYBER HACKS gives you the Best service in the Hacking world as our Success rate is Top Notch

      Be sure to 📱 💻 us via E-mail @

      Classic cyber notch at gmail dot com

      any time, any day to get the Best Professional hands involved in putting a smile on your face.
      We're Classic Hacks

      Signed,
      Collins .A.

      ReplyDelete

     
    Copyright © HACK | Designed by Muhammad Adeel | Founder UrduSecurity