Ok, here I go. WARNING!!: IT IS ILLEGAL IF YOU PERFORM ANY ACTS OR FORMS OF HACKING ON OTHER WEBSITES. I WILL NOT BE HELD RESPONSIBLE FOR ANY DAMAGE THIS INFORMATION CAUSES. Javascript Injection Summary: Javascript injection is a nifty little technique that allows you to alter a sites contents without actually leaving the site. This can be very usefull when say, you need to spoof the server by editing some form options. Examples will be explained throughout. Contents: Basics Cookie Editing Basics Javascript injections are run from the URL bar of the page you are visiting. To use them, you must first completly empty the URL from the URL bar. That means no http:// or anything. The two commands covered in this tutorial are the alert(); and void(); commands. These are pretty much all you will need in most situations. For your first javascript, you will make a simple window appear, first go to any website and then type the following into your URL bar: javascript:alert('Hello, World'); You should get a little dialog box that says "Hello, World". This will be altered later to have more practical uses. You can also have more than one command run at the same time: javascript:alert('Hello'); alert('World'); This would pop up a box that said 'Hello' and than another that says 'World'. To do this, first type: javascript:alert('Hello'); javascript:alert('World') The semicolon is the seperator. Cookie Editing First off, check to see if the site you are visiting has set any cookies by using this script: javascript:alert(document.cookie); This will pop up any information stored in the sites cookies. To edit any information, we make use of the void(); command. javascript:void(document.cookie="Field = myValue"); This command can either alter existing information or create entirely new values. Replace "Field" with either an existing field found using the alert(document.cookie); command, or insert your very own value. Then replace "myValue" with whatever you want the field to be. For example: javascript:void(document.cookie="Authorized=yes"); Would either make the field "authorized" or edit it to say "yes"... now whether or not this does anything of value depends on the site you are injecting it on. It is also usefull to add an alert(document.cookie); at the end of the same line to see what effect(s) your altering did. PM me, or post any quesitons or comments regarding this tutorial. A reply is always appreciated.
this is a great tutorial, there is more on this at www.hackthissite.org and opertunitys to use it legally if anybodys interested
