FirstBlood-#565 — Reflected XSS inside ref parameter on /register.php
This issue was discovered on FirstBlood v2
On 2021-10-26, neolex Level 2 reported:
Getting started
Learn about vulnerability types 
Getting started in bug bounties 
Test your knowledge
Free Web Application Challenges
Guides for your hunts 
ZSeano's Methodology
Effective Note Taking for bug bounties
Useful Resources 
Disclosed HackerOne Reports 
Our community
Endorsed Members
Hackevents 
Member Articles
Description
The ref parameter is vulnerable to reflected XSS
The value is reflected inside a <a> tag inside the webpage.
It can be use to open redirect but also can be upgraded to reflected xss with javascript uri
The javascript keyword is replaced by nope but the replace is case sensitive, and because javascript uri are case insentive we can bypass the filter by using an uppercase inside the javascript word.
Step to reproduce
- Open the following url https://8745a5db48cf-neolex.a.firstbloodhackers.com/register.php?ref=jaVaScript:alert(document.cookie)
- Click on
Return to previous page like the screenshot is showing
- The XSS is triggered
Impact
The impact is XSS, an attacker can execute javascript inside user's browser and they can steal cookies.
P3 Medium
Endpoint: /register.php
Parameter: ref
Payload: jaVasCript:alert(document.cookie)
FirstBlood ID: 32
Vulnerability Type: Reflective XSS
The parameter ?ref on register.php was poorly fixed and can be bypassed in various ways. Firstly the developer failed to use strtolower() when comparing strings, and the use of characters such as %09 will also bypass the filter.