FirstBlood-#209Rxss leads to ato accountakeover

On 2021-05-12, prob_hakz reported:





I have written a detailed report here of the impact of this short xss payload which is script inclusion

In the above payload it is just only alert

But we can do what ever we want like phishing, key stroke logging, account takeover by cookie stealing becuase there is no http only tag for cookie and can also able to steal appointments and entire source code with small snippets with ajax snippets fetch('//drpanel/index.php') and stealing the response and also for fetch('/drpanel/cancelled.php') and steling thre response with the .thenresponse =>response.text().then`data => console.log(data) why this fetch request work means becuase it is giviing ajax query to its own endpoints and so it work smoothly

so it would be any easy attack

The site accepting any script there is no cors here which made this attack possible

Becuase of script inclusion we can entirely attack the site as a bit attacker . tq for the hackevent sean

P3 Medium

Endpoint: /login.php?goto

Parameter: goto

Payload: "><script/src=//>

FirstBlood ID: 2
Vulnerability Type: Reflective XSS

The parameter "goto" is vulnerable to XSS on login.php. The web application makes use of a WAF but this can be bypassed as it's only looking for certain HTML tags and event handlers. It is also vulnerable to open redirect but XSS is the intended bug.

Respect Earnt: 1500000
RESPECT ($RSP) is an experimental cryptocurrency based on the Ethereum blockchain with the mission to show respect to those who deserve it. We are testing it out on our FirstBlood hackevent.