PHP Malware Analysis

xss.xml

md5: fc359db561c865da73f0ac6d3a7c4f3b

Jump to: 

Screenshot
No Image
Attributes
URLs

Deobfuscated PHP code
<html>
	<head></head>
	<body>
		<something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script>
		<a:script xmlns:a="http://www.w3.org/1999/xhtml">alert(2)</a:script>
		<info>
		  <name>
		    <value><![CDATA[<script>confirm(document.domain)</script>]]></value>
		  </name>
		    <description>
		      <value>Hello</value>
		    </description>
		    <url>
		      <value>http://google.com</value>
		    </url>
		</info>
	</body>
</html>

Execution traces
Generated HTML code
Original PHP code
<html>
	<head></head>
	<body>
		<something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script>
		<a:script xmlns:a="http://www.w3.org/1999/xhtml">alert(2)</a:script>
		<info>
		  <name>
		    <value><![CDATA[<script>confirm(document.domain)</script>]]></value>
		  </name>
		    <description>
		      <value>Hello</value>
		    </description>
		    <url>
		      <value>http://google.com</value>
		    </url>
		</info>
	</body>
</html>