I am doing a XSS challenge on HTB and have run into an issue. I have the unvalidated field that is vulnerable to XSS and so far I have got the below line to successfully call back to a python server on my box that is hosting a malicious script embedded in an html file.
The issue I have is that after the initial call from the top fetch the
index.html the malicious script which should be called from the html file is not getting called.
Maybe my understanding of this attack is wrong but I thought I should see first the call for the html file and then a call by the malicious JS.
The application is using HTTPS but my python server is HTTP.
Is my implementation wrong or my understanding of this attack vector?
I'm trying to then fetch this
html file containing a remote malicious script...
And this is my php script that is supposed to be receiving the file.
<?php header ('Location:https://intra.redcross.htb/'); $cookies = $_GET["c"]; $file = fopen('log.txt', 'a'); fwrite($file, $cookies . "\n\n"); ?>
The idea of the attack is that I run the first piece in the script tags, which fetches the html file which finally send the call with the (hopefully) admin cookie to my server and the php script to be written to a file.
I did also try this as the XSS payload but I only got the callback and no cookie data.