Forum Discussion

shubham's avatar
shubham
Icon for Bronze I rankBronze I
11 months ago
Solved

Cross-Site Scripting: Ep.6 – Further Exploitation

I was stuck in one question looking for HINT. Extend the XSS vulnerability to view the contents of the /admin/token page with SSRF.
help & support
  • CyberSharpe's avatar
    CyberSharpe
    11 months ago

    johndoe321I changed the script to a different port to the one being bombarded and did another NC listener on that different port. Roled right in. 

natelott's avatar
natelott
Icon for Bronze I rankBronze I
11 months ago

They key is knowing that you have to use python to host the remote .js file in parallel with netcat to listen for the response of the XSS malicious scripts.  Additionally, there are two steps to expose the data. One exposes the username and token cookie (question 1&2) in the query parameters.  The other displays the token in the html body.  The example code snippets work with VERY minor modifications.  One thing I did based on feedback from a peer, was to wrap Netcat in a look to keep it active in terminal for subsequent requests.