3

This question is related to a class project involving a team of 2 students against another team of two students. We both have servers with a default plugin that we have a week to patch vulnerabilities in, and another week to attempt to steal information from the other teams server. The server has 2 users and an admin with their passwords hashed on a mysql database on the server. We must gain access to the admin account and also deface the website in some manner.

My teammate and I have located a XSS vulnerability like so: www.example.com/dir/page.php?speed=--></script></head><script>alert("Problem here"); </script>. What are some common ways in which we could exploit this vulnerability to gain information or deface the website. Also, no users will be logging in and we cannot send a malicious link to anyone because no one will click on it.

  • Keep searching for other vulnerabilities? Phish their team? – John Deters Apr 12 '16 at 22:35
1

If you know for sure that no user will ever be logged in, you can't really do that much with a reflected XSS vulnerability (you can't steal cookies, you can't post requests on their behalf, you can't perform phishing attacks, etc).

I would still consider this a possibility to deface their website though. Sure, it's reflected, but if you post a specific link somewhere, and someone visits it, their website will show content you control, which obviously should not happen (and which is pretty much the definition of defacement).

If there may be a reason that the other team does log in (for example, the requirements may change, and the contest may require them to log in), no one will click a malicious link doesn't necessarily need to be an obstacle. You don't need to send the other team a link to their website, you just need them to visit a website where you can place JavaScript code. It does require a bit of social engineering, and may be difficult (as they are expecting attacks), but it doesn't necessarily have to be impossible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.