0

by trying the XSS room on THM, I try was trying to read the /etc/passwd using the following cmd:

<iframe src="/etc/passwd"></iframe>

However what I got is an error code as shown below enter image description here

But I was be able to read from css/style.css using:

<iframe src="css/style.css"></iframe>

enter image description here

Can somebody explain to me why ?

Note that this is a linux system:

80/tcp open  http    syn-ack ttl 64 Node.js (Express middleware)
|_http-favicon: Unknown favicon MD5: E49ECF40C7FDF87B783F5D2B575FE517
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: THM ~ XSS Playground
MAC Address: 02:F6:01:DB:D4:DF (Unknown)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|WAP|phone|webcam
Running (JUST GUESSING): Linux 3.X|4.X|2.6.X (95%), Asus embedded (94%), Google Android 5.X|6.X|7.X (92%)
OS CPE: cpe:/o:linux:linux_kernel:3.13 cpe:/h:asus:rt-n56u cpe:/o:linux:linux_kernel:3.4 cpe:/o:google:android:5 cpe:/o:google:android:6 cpe:/o:linux:linux_kernel:3.18 cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:2.6.17
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Linux 3.13 (95%), ASUS RT-N56U WAP (Linux 3.4) (94%), Linux 3.16 (94%), Linux 3.1 (93%), Linux 3.2 (93%), Android 5.0 - 5.1 (92%), Android 6.0-7.1.2 (Linux 3.18-4.4.1) (92%), Linux 3.12 (92%), Linux 3.2 - 3.10 (92%), Linux 3.2 - 3.16 (92%)
Improve this question

2 Answers 2

Reset to default
4
  1. Cross-Site Scripting (XSS) is a client-side vulnerability. It allows you to run client-side code (mostly javascript) on the victims' browser using a vulnerable website. This means using XSS you can not exfiltrate /etc/passwd from the webserver.
  2. To read the arbitrary file from the webserver, the website must be vulnerable to local-file-inclusion (LFI) vulnerability.
  3. You need to read the question carefully :), it is asking you to create a pop-up with different values. For the first task you can try something like below:
<iframe src="HTTP://anything" onmouseover="alert('Hello')"/>

This above code will trigger javascript when user moves the mouse, and display alert box with "hello". Try to solve the second task by yourself. Basically, you need to replace the 'Hello' with the machine's IP address.

PS: PortSwigger Web Academy is one of the best resources where you can learn about web security. I learn from web security there.

Improve this answer
1
  • thanks, I just am just "trying to be smart" haha Thanks!
    – user1998844
    Commented Jul 29, 2021 at 12:45
3

When you set /etc/passwd, it is a URL, so starting with /, it's relative to the current site, which explains that you get a 404 error from the web server.

You need to use the file:///etc/passwd format. Maybe other things too, that's just your immediate issue

Improve this answer
2
  • hI Thanks! but now all I get is a white pic box. <iframe src=file:///etc/passwd></iframe>
    – user1998844
    Commented Jul 29, 2021 at 2:04
  • You don't have the right to read the file . Another important XSS to file read works only in dinamicaly generated pdf. Because XSS is server side
    – Marco Nappi
    Commented Jul 30, 2021 at 11:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .