0

I am trying to find stored XSS in an application. Luckily, the application allows me to insert and edit the description of myself that is displayed to anyone visiting my profile.

The location where I edit my description: http://example/edit_desc?content=test

Page where the edited description is displayed: http://example/user

Coming to my problem, how can I configure zap's request editor in such a way that when I send request in the http://example/edit_desc?content=test, the response for http://example/user is displayed?

NOTE: One possible thing I thought of was to include Location: http://example/edit_dec?content=test as header of every response but figured out no way to do it in the Request editor.

1

edit: working solution below!

I would look at building a proxy rule script to check for the URL path being called, and then make a call to the 'response' path.

Examples: https://github.com/zaproxy/zap-core-help/wiki/HelpAddonsScriptsScripts

Here is the example template for proxy scripts: https://github.com/zaproxy/community-scripts/tree/master/proxy and the corresponding documentation for the HTTPMessage object that you'd be handling: https://www.zaproxy.org/2.5/javadocs/org/parosproxy/paros/network/HttpMessage.html


simple solution

I don't work with javascript(mostly a python guy), but let's see if we can work through a basic script:

Here's the example JS proxy script template linked above:

/**
 * This function allows interaction with proxy responses (i.e.: 
inbound from the server to the browser/client).
 * 
 * @param msg - the HTTP response being proxied. This is an HttpMessage object.
 */
function proxyResponse(msg) {
// Debugging can be done using print like this
    print('proxyResponse called for url=' + 
msg.getRequestHeader().getURI().toString())
    return true
}

So if we want to go somewhere else, we can try a 307(temporary redirect) like so:

function proxyRequest(msg) {
return true
}

function proxyResponse(msg){
    print(msg.getRequestHeader().getURI().toString());
    if (msg.getRequestHeader().getURI().toString().contains("edit_desc?content=")) {
        print("Found the URL!");
        var uri = msg.getRequestHeader().getURI().toString()
        var username = uri.match(/content=(.*)/)[1];
        var redirUrl = "http://example.com/"+username;
        msg.getResponseHeader().setStatusCode(307);
        msg.getResponseHeader().setHeader("Location", redirUrl)
    return true;
    }
}

If you throw that in a new proxy script(if you're having trouble with it not letting you make a new script, duplicate another and replace everything), enable it, and voila, it redirects any requests with 'edit_desc?content='user to 'http://example.com/user' after submitting the request to the server.

script in action

script enabled:

script

request in history: request_history

response view:

response

browser state:

browser

  • Can you please approve the edit ? Thanks for your answer! – Then008 Jul 21 '18 at 8:35
  • It's working but only in requests made by the proxy. It is neutral to any requests made from the Request Editor. For that to work in Request Editor, the script has to be belonging to the HTTP Sender instead of HTTP Proxy. For that the script posted above requires tweaks and changes but it's similar. – Then008 Jul 22 '18 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.