I am attempting to perform an XSS attack on my server and have successfully bypassed the CSP. In my server code, I store all users in the following manner:

  .get("/users", adminReq, (req, res) => {

Due to the adminReq middleware, which is simply a check to verify if the requester is an admin, I am unable to retrieve the data within /users.

When an attacker executes an XSS attack within a text input, the following code effectively works only when adminReq is removed:

<SCRIPT src="https://cdnjs.cloudflare.com/ajax/libs/prototype/1.7.2/prototype.js"></SCRIPT>
 <SCRIPT src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.0.8/angular.js"></SCRIPT> 

<div ng-app ng-csp>       
 {{$on.curry.call().eval("fetch('/users').then(response => 
   response.json()).then(data => alert(JSON.stringify(data)))")}}

How can an attacker retrieve the data through XSS despite the presence of the middleware?

  • they'd attack the admin. Btw, are you trying to XSS from the angular template?? An attacker wouldn't be able to do that. That's all in the build. Commented Apr 26 at 20:15
  • I wanted to bypass CSP so that is why book.hacktricks.xyz/pentesting-web/… My first attempt was just to steal cookie from a user that clicks on a link for instance. But because HTTPOnly is used I was not able to do that.
    – EPiez
    Commented Apr 27 at 8:05
  • once you can run your scripts in the user's same-domain context you can use that cookie without knowing it's value. Commented Apr 30 at 18:03


You must log in to answer this question.

Browse other questions tagged .