Tocmai m-am uitat prin RSS reader si am dat peste ceva interesant postat pe SecurityTube.Net :

XSS Shell is powerful a XSS backdoor and zombie manager. This concept first presented by XSS-Proxy. Normally in XSS attacks attacker has one shot, in XSS Shell you can interactively send requests and get responses from victim. you can backdoor the page.

You can steal basic authentication, you can bypass IP restrictions in administration panels, you can DDoS some systems with a permanent XSS vulnerability etc. Attack possibilities are limited with ideas. Basically this tool demonstrates that you can do more with XSS.

XSS Shell has several features to gain whole access over victim. Also you can simply add your own commands. Most of the features can enable or disabled from configuration or can be tweaked from source code. The main feature in XSS Shell is ‘Page Regeneration’. XSS Shell re-renders the infected page and keep user in virtual environment. Thus even user click any links in the infected page he or she will be still under control! (within cross-domain restrictions) In normal XSS attacks when user leaves the page you can’t do anything. Secondly this feature keeps the session open so even victim follow an outside link from infected page session is not going to timeout and you will be still in charge.

In this video, killer3027 shows us a demo of the Xss Shell. Thanks go out to zitstif for referring this video to us!

Video : http://securitytube.net/XSS-Shell-Demo-video.aspx

Ok , partea interesanta este urmatoarea : killer-tr este un amic de al meu de pe warezforum.info .
Ghiciti voi cine este Kabron din video respectiv .

x5s is a Fiddler addon which aims to assist penetration testers in finding cross-site scripting vulnerabilities. By auto-injecting special character-probes x5s can detect where an emitted character may be ill-encoded or transformed and vulnerable to XSS attacks. The methodology used by x5s is to inject small probes which do not constitute a working XSS payload. In other words, x5s will not inject XSS payloads anywhere, it merely aims to identify character encoding and transformation issues that lead to XSS.

The x5s tool will automate testing all of the GET and POST input parameters on the target application, then present the findings in a grid-display for quick visual analysis. The tool goes further by auto-injecting special characters (e.g. higher Unicode, overlong UTF-8) to detect transformations that could lead to XSS. x5s has an extensible design allowing for custom request parsers to be quickly implemented. For example, if the target application uses some custom XHR request format that resembles a hybrid between JSON and RPC, you could implement a parser so all of those inputs would be properly tested.

Download and more info: http://xss.codeplex.com