Forum Discussion

IronLady18's avatar
IronLady18
Icon for Bronze I rankBronze I
2 months ago

Re: Cross-Site Scripting: Ep.6 – Further Exploitation

I'm also stuck and cannot get the script to display the admin/token page.  I'm using the script from the XSS and SSRF section.  From that script I changed
line 2 the I changed the open to use /admin/token

and on line 8 I changed the ip address to be the one given for the Kali Desktop and I'm using port 4848

In the wildcard-cycles.bitnet website on the  Ask a Question page in the Message text box I'm using the script call from the Remote scripts section of the Briefing.  I changed the ip address to be the Kali Desktop with port 4848. 


I am using the python3 http.server call to listen.  When I click the Post button I can see that the script has gotten called but no other information is being produced. 

I'm not sure what I'm doing wrong. Any help would be greatly appreciated.

help & support
  • ChrisKershaw's avatar
    ChrisKershaw
    Icon for Community Support rankCommunity Support
    31 days ago

    Hey IronLady18 

    I'm sorry that you are continuing to have issues completing the lab.

    I'll tag, below, one of my colleagues from our lab Content Team, to see if they can help at all, so we can get you moving on this.

    NyePrior - Is there anything you can advise, to help the user progress?

    • NyePrior's avatar
      NyePrior
      Icon for Immerser rankImmerser
      31 days ago

      👋 IronLady18, you're doing 99% of the steps correctly, the problem lies with the fact you're using port 4848 to both host the script.js file and receive the connection back from the server. You'll also need a listener (I like using netcat, as it's simple!) to catch the connection from the server, and output the contents of the request. 

      For example, to spawn a listener on port 4444, you would run: 

      nc -nvlp 4444

      You'd need to adjust the script.js file to match whatever port you choose to host your listener on.

      Hope this helps! 

       

    • IronLady18's avatar
      IronLady18
      Icon for Bronze I rankBronze I
      2 months ago

      Thanks, I'm still stuck any help is greatly appreciated.  I'm sure it is just something small I'm missing or mistyped