FirstBlood-#789 — Reflective XSS at /register.php
This issue was discovered on FirstBlood v2

On 2021-10-28, 0xirfan Level 5 reported:

Summary

The ref paramter in the /register.php is Vulnerable to XSS. The input Provided in the ref parameter is reflected at href value of an anchor tag.

for the XSS to trigger the Victim need to Click at the Return to previous page Link

Finding the Payload

As the input is reflected into anchor tag's href value . I started with the classic javascript:alert(1) . I found that they were performing some filtering in the Server side . It Changed to nope:alert(1) So I changed the Payload to JaVaScript:alert(1)

Steps

1) Just Send this URL to the Victim

                   https://05ecafffaada-0xirfan.a.firstbloodhackers.com/register.php?ref=JavaScript:alert(document.cookie)

2)if the Victim Clicks the Return to previous page Link. XSS will be triggered

Impact

The XSS can be used to steal cookies which leads to ATO

P3 Medium

Endpoint: /register.php

Parameter: ref

Payload: jAvascRipt:prompt(%271%27)

FirstBlood ID: 32
Vulnerability Type: Reflective XSS

The parameter ?ref on register.php was poorly fixed and can be bypassed in various ways. Firstly the developer failed to use strtolower() when comparing strings, and the use of characters such as %09 will also bypass the filter.