I have been trying to analyze my router modem and see how it works and check for possible vulnerabilities in the system . and i would like some help .
Router Security Research :
router access ip : 192.168.1.1
first the web server do a check :
if (user_level == -1) {
location.href = "admin.html";
//if user_level == -1 // get him back to the login page
the web server get the " user_level " from a javascript file .
location : http://192.168.1.1/users.sjs
var currentUser = "error"; var user_level = -1;
i don't know how the web server can send values to this script ! is this script have global variables ?
if the login is succesfull : the javascript file values :
location : http://192.168.1.1/users.sjs
var currentUser = "technicolor"; var user_level = 15;
/// current user check :
if (currentUser == "technicolor") {
location.href = "thomson/index.html";
}
so the web server give acces if the users.sjs have technicolor and 15 as variables values !
the login page send a POST request to this file :
POST /cgi-bin/basicauth.cgi?index.html HTTP/1.1
one of the request variables is failrefer
if the login failed he will redirect him to /admin.html
and i found that this post variable have an XSS vulnerability
:
&failrefer=/admin.html</script><script>confirm(1)</script>
i really want to know what you think ! is there a way that someone can access my router control panel if he found these vulnerability ! thanks :)