I found out that there is a reflected XSS on the
/login.php endpoint through the vulnerable
ref parameter which leads to account takeover.
Steps to reproduce
- Open the following link:
- Click on the
Return to previous page and the XSS pops-up:
I found out that certain keywords are being blocked and removed, I realized
java%09script but then I realized using this payload
java keyword is removed, also realized
alert keyword and
( are being removed.
I used the following tricks to bypass the filtering:
( ) -->
- You can use multiple encoding/unicoding tricks to bypass the
You can use
prompt if keywords such as
alert is blocked.
When parentheses are filtered you can either use
` ` as I did, or in some cases you can use encoding tricks such as HTML encode or URL encoding/Double URL encoding.
confirm(1) --> confirm`1`
An attacker can craft a payload to steal cookies, an example of such payload is:
http://attacker.com is the attacker's domain, opening the above link and clicking on the
Return to previous page results in a redirection to the attacker's domain and the cookies will be sent to the attacker's server.
An attacker can set this cookie on his browser to access
This happens because of two cookies misconfiguration:
Cookies are not set as
Cookies are not deleted/expired as they meant to be after logging out, which makes it possible for an attacker to re-use the cookies whenever he wants to.
Set-Cookie: drps=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
ref parameter should not be controlled by users.
- Preferably set