Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm testing a phishing website on a staged replica of an jsp web-application. I'm doing the usual attack which involves changing the post and action field of source code to divert to my own written jsp script capture the logins and redirect the victim to the original website.

It looks easy, but trust me, it's has been me more then 2 weeks and I cannot write the logins to the text file. I have tested the jsp page on my local wamp server it works fine. In staged, when I click on the ok button for user/password field I'm taken to script. I checked this using the tamper data add-on on Firefox. The only way I was able to make my script run was to use burp proxy intercept the request and change action parameter to refer my uploaded script.

I want to know what does an I have googled it - it's quite common to see it in jsp application. I have checked the code; there is nothing that tells me why the page always points to the .do script instead of mine. Is there some kind of redirection in Tomcat? I like to know. I'm unable to exploit this attack vector? I need the community's help.

share|improve this question

closed as too localized by schroeder, Terry Chia, Lucas Kauffman, Rory Alsop Oct 1 '12 at 11:35

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

First, I don't think 'phishing' comes into this at all. Second, you are leaving out a ton of detail. Are you trying to perform code injection (XSS/CSRF) to capture login data? If the 'action' is 'Login', the script of the site will run the script it is designed to use to log in, which won't be your code. You need to inject other code to also write the login info to another location even when the login script is run. Unless you have access to the scripts themselves, you cannot change this. – schroeder Sep 27 '12 at 14:47
@ schroeder Its very simple let me sent you a link.… Thats all I'm doing. I just want the site to redirect to my jsp script when ok button is clicked instead it goes page. There is nothing in the login page source code to tell this action. – Saladin Sep 27 '12 at 15:22
up vote 1 down vote accepted

You are trying to do a MITM attack by copying the files from the Google login page? We cannot help you. There are too many variables to consider and then this question becomes far too localized to your situation.

Check out SET for better, more complete methods of doing what you propose, and you will learn far more than the mini-tutorial you linked. Look through the SET code once a fake page is set up and you will learn far more.

For deeper knowledge, flip through The Web Application Hacker's Handbook. It is more detail than you need right now, but is the bible for web application hacking.

share|improve this answer
Not its not mitm attack. It just what the link says it is. I;m changing this code on tomcat directories since i got a root access to the webserver machine. I have change the login.jsp page to point to my script. When the script is reached it captures users logins and write to a file. I tried running the login.jsp on my test web-server and it works just fine but when i try on the victim webserver it takes me to loginAction. do? – Saladin Sep 27 '12 at 16:05
Then this is not a hacking, or a security-related question at all. If you have direct access to the code on the victim, this problem is pure web coding. I see that you have cross-posted this question to other SE sites that might help, just remove all refences to 'phishing' because there is nothing in your problem related to 'phishing'. – schroeder Sep 27 '12 at 16:40
Well thank you for sending me the SET link. It's awesome. Yeah its not phishing because the details are missing but for my perspective it is i just don't want those details out in public. I don't want context. Thanks for the set link. I would approve your answer. You are nice fellow – Saladin Sep 27 '12 at 18:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.