0

I want to exploit an DOM XSS vulnerability which is caused by the application handling the cookie in an insecure way. Only I would need to set the cookie to a specific value to exploit the issue. While I could do this with Javascript I don't already have XSS on the page so I cannot use Javascript to set the cookie.

Are there generic ways to set the cookie without having XSS on the page already? Or are there any other possible vulnerabilities I might have to look for which might help me in setting the cookie?

closed as unclear what you're asking by Anders, Eric G, David, Tobi Nary, Rory Alsop Jan 8 '18 at 10:35

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • i will make a bounty on this one it's very hard – zerocool Jan 6 '18 at 13:22
  • 1
    I consider your question as too broad. There is no generic way to exploit what you want but there might be ways if the applications are vulnerable in other ways. You might get some ideas when reading Cookies Lack Integrity: Real-World Implications. – Steffen Ullrich Jan 6 '18 at 13:53
  • @SteffenUllrich yup that's true dude, it's in Facebook and i don't have any idea right now how to move froward with this vulnerability as u know D-xss the amount of money for it is very low event Facebook so i need a way to move it to the next level so i can have good bounty from them – zerocool Jan 6 '18 at 13:59
  • This information does not make the question better. Or do you really expect others to start looking for usable vulnerabilities in Facebook and tell you about it so that you can get a bug bounty? – Steffen Ullrich Jan 6 '18 at 14:06
3

Yes, unless you can set cookies of you choice, it's not really exploitable.

Are there generic ways to set the cookie without having XSS on the page already?

Yes! There are basically 3 ways we can set cookies in a browser;
1. Via Set-Cookie response header
2. Via HTML <meta> tag
3. Via JavaScript document.cookie

So, what you need is either of;
- HTTP Header Injection
- HTML Injection
- XSS

Since you only need cookies, also try looking for vulnerable subdomains for aforementioned vulnerabilities. There was a bug in Firefox which also allowed setting cookies from SVG images with <img src>, please refer to;
http://insert-script.blogspot.com/2016/12/firefox-svg-cross-domain-cookie.html

And, just to be complete, you can also use network level hacks like MITM, DNS Hijacking, and so on.

Not the answer you're looking for? Browse other questions tagged or ask your own question.