+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: XSS in HTTP Header refefer (/showthread.php?tid=5357807)
XSS in HTTP Header refefer - whatadumbass123 - Jul 30, 2016
Parameter Name Referer
Parameter Type HTTP Header
I use tamperdata and create Post data name=Expect and name=Refer
>
In them i put the scriptalert.on.cookie It shows me the sites cookies
Now i want to know Whats the best about getting admin logins? Or users?
Can i do it without sending any links?
* - Mafius - Jul 30, 2016
To session hijack with non-persistent XSS you MUST send a link.
You'd have to host a page that would redirect the target to the vulnerable page, injecting the session hijack JS into the referer header. I believe this could be accomplished with PHP's header() function.
* - whatadumbass123 - Jul 31, 2016
(Jul 30, 2016 10:12 PM)Mafius Wrote: To session hijack with non-persistent XSS you MUST send a link.
You'd have to host a page that would redirect the target to the vulnerable page, injecting the session hijack JS into the referer header. I believe this could be accomplished with PHP's header() function.
My scanner says I can do mitm attacks , even set up mount phising pages? Change pages on the fly?
* - Mafius - Jul 31, 2016
(Jul 31, 2016 01:48 AM)whatadumbass123 Wrote: My scanner says I can do mitm attacks , even set up mount phising pages? Change pages on the fly?
After looking into it, it appears browsers handle referer headers all by themselves - so what I suggested isn't actually possible.
MITM attacks could work if you are physically near them.
* - .trigious - Jul 31, 2016
(Jul 31, 2016 11:32 AM)Mafius Wrote: After looking into it, it appears browsers handle referer headers all by themselves - so what I suggested isn't actually possible.
Yes it is. I tried it before. You have to play around with URL rewrites, but it is possible.
Requirement on the vulnerable website is that the Referer needs to be URL decoded before being echo'd. (:
* - Mafius - Jul 31, 2016
(Jul 31, 2016 02:40 PM)Trigious Wrote: Yes it is. I tried it before. You have to play around with URL rewrites, but it is possible.
Requirement on the vulnerable website is that the Referer needs to be URL decoded before being echo'd. (:
Didn't say it wasn't possible, just said what I suggested wasn't the way to do it.
* - .trigious - Aug 1, 2016
(Jul 31, 2016 03:30 PM)Mafius Wrote: Didn't say it wasn't possible, just said what I suggested wasn't the way to do it.
Yes, your way is possible.
Since most OSs' will stop you from creating files that are a javascript payload, you will need to simply change the 404 page of your server to a script that will redirect the user to the vuln page.
So:
1. Victim visits evil.com/payload here
2. he gets a 404 error because the file does not actually exist
3. the 404 page redirects the user to the other vuln website
4. the referer now contains the payload, which is url encoded
5. the vulnerable website decodes the Referer and echo's it onto the page
6. XSS
This is very unlikely but possible. (: