cracking websites through JAVASCrIPTS

Javascript Injection |A Closer Look

initially Posted by Ivan Blazevic(hackspc)

 Now today in this tutorial, I’ll guide you through the window where you’ll get more closer vision in javascript injection and it’s prevailing uses. OK, now let’s begin with the tutorial.
Besides changing cookies (in my previous tutorial), you can change other things as well. One of them is changing form values.
Consider the following text field in a money transfer form:

<form action=”submit.php” method=”post”>
<input name=”amount” type=”hidden” value=”1? />
</form>

Assume that above code is the source code extract from a form which sends $1 to your account every time the form is submitted. Lets say that you want to receive $100, how would you do that? The problem in this form is that this form remains invisible since its type is set hidden and neither can you change the value of the invisible field.
By using javascript injection technique you can change the form value easily.
For example to change the value of the above form, you can inject following javascript code:

Javascript: void(document.forms[0].amount.value="100");

The value of the input named amount will change to 100 by applying above injection. The syntax to change form is,

The Green colored text must contain numerical value, the numerical value is the form number where 0 means the first form and 1 means the second form. The orange colored text must contain the name of the input type. For example, in the above form we’ve input name of first form as amount. The blue colored form contains the value to be kept in the input form.
Have a look at following image demo:



You have the form that cannot be modified directly but it is visible.

Now when you look at the source code, you’ll see that it is disabled and you cannot edit the value of this form. This is where you’ll plan and study for javascript injection. Find which form is it, first second or third. If it is first then you must input 0 in the forms[#]. Find out the name of the form and enter the value you want.

Now after everything is planned and fixed, you’ll prepare the javascript injection code and inject it from your browser’s address bar.



Now alert box will show up, this will confirm that the javascript injection went successfully.



Now when you press OK button, you’ll have the form value changed eventually.
In this way you can change the form value easily.
And for some extra fun you can change the title of the website by using following code:

Javascript: alert(document.title = "title name");

This will change the title of the website.
For example,
In Google.com, javascript: alert(document.title); will load the following alert bod.

 

And when you inject page title javascript injection, you’ll get following result.as in above image


THIS DATA IS FROM HACKSPC

ENJOY------------------------------------------------------<><><><><><><><><><><><><><>