0

I'm using the mutillidae to increase my hacking skills. I am trying to exploit the XSS in the username field in the registration form field with the toogle security 5. I tried everything that I know, but I still didn't manage to exploit it.

From the inspect element of that field (username):

<input htmlandxssandsqlinjectionpoint="1" name="username" size="15" autofocus="autofocus" minlength="1" maxlength="15" required="required" title="" type="text">

Can anyone please tell me why the payloads didn't work? What filters are in use?

closed as off-topic by tim, S.L. Barth - Reinstate Monica, Steve, Serge Ballesta, Matthew May 3 '17 at 8:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – tim, S.L. Barth - Reinstate Monica, Steve, Matthew
If this question can be reworded to fit the rules in the help center, please edit the question.

1

For starters, the HTML input tag in this case is set to restrict input to 15 characters, so your standard <script>alert(1);</script> won't fit. This can probably be circumvented by using an attack proxy such as OWASP ZAP or Burbsuite, which will allow you to submit responses that wouldn't normally be accepted.

There is no way to tell what server-side filters are in place by simply looking at the HTML code. HTML is client-side, and client-side security can almost always be bypassed. (Much like the character limit described above.) It is likely that there are multiple layers of filtering that go on in the server after you submit the form.

There are two steps that you should try. First, rather than starting off with a whole payload script, try just entering specific characters and combinations of characters, such as < and >. See what characters get filtered out, and which ones become encoded or remain unfiltered. Then try to craft an attack string that will bypass the filtering or is the decoded form of what you actually want.

The other thing you should do is to run a fuzzer on the application. This will try a very large number of different attack strings, to try to find one that gets by the filtering.

  • but the request is not submitted so i can't see the response, because of this error, Blacklisting is l33t like l33tspeak. @Kernel Stearns – Utkarsh Agrawal May 2 '17 at 12:17
  • 1
    Could you clarify what request you submitted, and what the error code was? Maybe you should do some research as to whether other people have had trouble with that same problem in Mutillidae. – Kernel Stearns May 2 '17 at 13:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.