When I am requesting for a password reset, it's making a request like this ->

{"eval":"uiFormNotify('messageDiv', 'info', 'msg.email_reset_to_existing', 10);Metronic.unblockUI('#forgotPwdForm');$('#forgotPwdForm').html($.t('msg.may_close'));"}

And after replacing a msg.may_close with xss payload it's actually executing. may_close is a string variable initialized in .json

So can anyone suggest me how can I make a valid PoC for this?

  • 4
    I'm confused, if you can execute a payload, then you have your PoC right there. – schroeder Jun 1 at 7:44
  • Yeah I’m with @schroeder. If your audience is more skeptical, prove the payload is executing on the target’s domain (i.e., “alert(document.domain)”). But that’s about all you’d need to do. – securityOrange Jun 1 at 14:35
  • payload is executing ,but its a msg from websockets not a server request so it does not contain any headers and we cant even sent that to repeater in burpsuit so I am confused because I cant see any way to create exploit for it. – LUs3r Jun 2 at 8:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.