1

I am testing a bug bounty website and i reached a support ticket creation functionality. I registered with email address {{15*15}}@testemail.com. I created a ticket but when i try to open the ticket i noticed a call to https://www.website.com/undefined and i am not able to open the ticket, it keep saying "loading ticket" but it never loads. I believe that this error is caused by {{15*15}} that is injected in some javascript file and generate that error. I tried to register with emails like "></script><xss>@email.com or alert(1)@gmail.com but the email in registration page is controlled and doesn't let me register with invalid emails. Can i execute some javascript code or exploit this issue as dom based xss? If possible what payload could i insert inside email field?

closed as off-topic by Steffen Ullrich, LvB, Xander, tlng05, this.josh Jun 14 at 4:44

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – LvB, Xander, tlng05, this.josh
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Is email validation done client-side? Also, I highly recommend looking into blind XSS and tools such as XSSHunter: xsshunter.com. – EdOverflow May 25 at 12:50
  • @EdOverflow, I think their support ticket system is made by zendesk but the problem here is with one of their script. I think this is the code generating the error {var i=this.users[o];t.author_id===i.id&&(t.author_nickname=i.name,t.author_avatar=i.email===this.user.email?this.user.avatar:i.photo.content_url? The problem is that email is validated server side and it block regular brackets () while curly brackets are allowed. – new liyuser May 27 at 17:20
0

Could you please share errors written at console ?

This type of contents does not send to browser over js files, I believe you can find it in a response of document request or initial response. Most of the time you can find it at html response or API response (json/xml etc.).

If you want to check XSS, follow items listed below.

  • Find the input at response (alert(1)@gmail.com
  • Check, is app do html encoding/decoding (write <> and check response is <> or <>)
  • If it does not handle correctly, find the right payload

You are working with stored XSS so you can follow this link https://www.owasp.org/index.php/Testing_for_Stored_Cross_site_scripting_(OTG-INPVAL-002)

You can find out example payloads at link written below https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

PS. This situations can be a simple frontend error so check the reason first (reason of "loading tickets").

  • In console i have the following errors: pid-user-file-min.js:1 ERROR TypeError: Cannot read property 'content_url' of null at e.getUsers (pid-user-file.js:1) [...] Failed to load resource: the server responded with a status of 404 () undefined:1 – new liyuser May 27 at 19:47
  • I believe no because most of the time at that step you need to see a syntax error. Second scenario: your payload is not injected properly this why it will not giving syntax error, you can try bypass registration page for injecting html tags (<script>alert();</script>). For being sure you can follow items listed at previous message. – alnbhclyn May 28 at 7:38
  • Did you get that the payload is injected in email input? < and > are blocked, also normal brackets are blocked. – new liyuser May 28 at 8:05
  • Yeap got it.. I am talking about evading your payload, please have a look to owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet. Also, if this "invalid mail" validation done at frontend (JS) you need to send this data directly to backend and check what is happening. – alnbhclyn May 28 at 8:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.