XSS Challenge - tesco.com - med (?)

XSS Challenge - tesco.com - med (?) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: XSS Challenge - tesco.com - med (?) (/showthread.php?tid=3601534)

Pages: Pages 1 2 3

XSS Challenge - tesco.com - med (?) - Cathal - Jul 6, 2013

I usually hate these kind of threads, but this one took me fucking ages, even though the end vector was unbelievably simple.

Here's the site: http://www.tesco.com/

[img]http://aspectmodding.net/cap/15d1b0853d0a0a7a77cd.png[/img]

And here's the proof:
Spoiler (Click to View)

Oh, pm me dem vectors.

Solvers
xXSehgalXx
cheatson
Gee4rce
PuzzuS

EDIT - ._. Easy challenge is easy.

* - Anarchist001 - Jul 6, 2013

Damn, it is a dot.net site I guess..it doesnt allow <s ... hmm..very tricky..how did you solve it, I must know

* - xXSehgalXx - Jul 6, 2013

Easy - Test your basic knowledge

Spoiler (Click to View)

* - cheatson - Jul 6, 2013

This wasn't trivial for me at all although may have reinvented the wheel for it in the end. Good challenge!

[Image: R1elM2z.png]

* - Possession - Jul 6, 2013

What can you do with with it? Tesco is a one of the largest supermarket in the UK.

* - Anarchist001 - Jul 6, 2013

Did you find it in the search function?

* - Cathal - Jul 6, 2013

(Jul 6, 2013 08:34 AM)Anarchist001 Wrote: Did you find it in the search function?

I'm sorry, didn't you say you were a pentester?

* - Anarchist001 - Jul 6, 2013

yeah, did you bypass the :
dangerous request.form error
There isnt an error, but if there was no custom field.

By the url, I can see that you are in the homepage.. can u XSS the search box...or is it not possible?

* - Cathal - Jul 6, 2013

(Jul 6, 2013 08:51 AM)Anarchist001 Wrote: yeah, did you bypass the :
dangerous request.form error
There isnt an error, but if there was no custom field.

By the url, I can see that you are in the homepage.. can u XSS the search box...or is it not possible?

This is a challenge, mister pentester.

* - Anarchist001 - Jul 6, 2013

On what browser did you do the injection?

* - 0rph4n - Jul 6, 2013

ah this is irking the sh!t out of me lol, I am close I think.. Im still learning this. Will post results soon as i figure it out

* - Gee4rce - Jul 6, 2013

Done.
Yes i would rate this one as a medium -
finally, a Challenge wich really included some challenging part (after tons of standard <script>alert(0)</script> search box 'challenges' which have been postet in the past)...

[img]http://img442.imageshack.us/img442/1563/frgm.png[/img]

Thanks for the challenge!

PS.:
Ohh, there was also some sort of Redirect problem, here;

(Copy & Paste for demonstration)

Code 
http://www.tesco.com/r/?from=HomePageHelp&url=//pwnyc0d3.t.gp/b00bs/

Greets, Gee 😅

* - domex27 - Jul 6, 2013

(Jul 6, 2013 11:45 AM)Gee4rce Wrote: Done.
Yes i would rate this one as a medium -
finally, a Challenge wich really included some challenging part (after tons of standard <script>alert(0)</script> search box 'challenges' which have been postet in the past)...

[img]http://img442.imageshack.us/img442/1563/frgm.png[/img]

Thanks for the challenge!

PS.:
Ohh, there was also some sort of Redirect problem, here;

(Copy & Paste for demonstration)

Code
http://www.tesco.com/r/?from=HomePageHelp&url=//pwnyc0d3.t.gp/b00bs/

Greets, Gee 😅

n00b i dont click on site , you are n00b it a lfi?

* - Gee4rce - Jul 6, 2013

(Jul 6, 2013 11:51 AM)domex27 Wrote: n00b i dont click on site , you are n00b it a lfi?

lawl, you call le me a n00b :D ?!
Well if thats an LFI then go and report it - you will get amazingly tons of Ca$$$$h !!!! 🤣

"you are n00b it a lfi?"
(erm... English?)

* - MFFS - Jul 6, 2013

(Jul 6, 2013 11:45 AM)Gee4rce Wrote: PS.:
Ohh, there was also some sort of Redirect problem, here;

(Copy & Paste for demonstration)

Code
http://www.tesco.com/r/?from=HomePageHelp&url=//pwnyc0d3.t.gp/b00bs/

Greets, Gee 😅

I will never ever again click on any your link. I think i am dead.