+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: XSS steal basic auth (/showthread.php?tid=6149116)
XSS steal basic auth - Tessaiga88 - Apr 13, 2021
https://medium.com/@agrawalsmart7/steal-csrf-auth-unique-key-header-with-xss-5a54c38d7ec3
With XML request you can steal response header.
But, what if you want steal REQUEST header like the Authorization from basic auth? Any idea?
Thanks for help
RE: XSS steal basic auth - rAmUnDo - Apr 13, 2021
I'm looking to hire and pay well for those who know how to gain root access to sites and extract files ... Paid for each invasion ...
RE: XSS steal basic auth - Gee4rce - Apr 14, 2021
(Apr 13, 2021 11:28 AM)Tessaiga88 Wrote: But, what if you want steal REQUEST header like the Authorization from basic auth? Any idea?
One idea, "form action hijacking", where you need another vuln like XSS for example,
to rewrite the forms "action" destination to a server you own. On there, you want to
monitor the incoming requests and filter out the headers of the requests, which will
ultimately show you the sent Authbearer.
Maybe CSRF or SSRF vuln could also open doors to this.
Cheers, Gee.
RE: XSS steal basic auth - Tessaiga88 - Apr 15, 2021
(Apr 14, 2021 02:54 PM)Gee4rce Wrote: One idea, "form action hijacking", where you need another vuln like XSS for example,
to rewrite the forms "action" destination to a server you own. On there, you want to
monitor the incoming requests and filter out the headers of the requests, which will
ultimately show you the sent Authbearer.
Maybe CSRF or SSRF vuln could also open doors to this.
Cheers, Gee.
Thanks for reply. Probably not possible for my situation.
I have web site target example 'https://target.com' where 'https://target.com/abc/' is protected by basic auth. But only the /abc/ path. So if you catch headers from another path, you dont get the 'Authorization' header.
RE: XSS steal basic auth - Tessaiga88 - Apr 24, 2021
up, still looking for a way to get http request header from specific request, starting from XSS vulnerability
RE: XSS steal basic auth - Shadow_Cloud - Apr 27, 2021
(Apr 13, 2021 11:28 AM)Tessaiga88 Wrote: https://medium.com/@agrawalsmart7/steal-csrf-auth-unique-key-header-with-xss-5a54c38d7ec3
With XML request you can steal response header.
But, what if you want steal REQUEST header like the Authorization from basic auth? Any idea?
Thanks for help
Do you know the tech stack in question here? I remember, although admittedly only vaguely, about an exploit for this by utilizing phpinfo() by accessing the data from PHP_AUTH_USER and PHP_AUTH_PW.
I'm not sure if this is still relevant, I'm talking years ago, but might be worth exploring?
Edit: Obviously I mean making an ajax request to the server that contains phpinfo on it after auth has been done. This would require a lingering phpinfo page on the server, but its actually more common than most people imagine.
Edit2: There might also be a play for a service worker and using fetch > https://developer.mozilla.org/en-US/docs/Web/API/Request
RE: XSS steal basic auth - Tessaiga88 - Apr 30, 2021
(Apr 27, 2021 11:35 PM)Shadow_Cloud Wrote: Do you know the tech stack in question here? I remember, although admittedly only vaguely, about an exploit for this by utilizing phpinfo() by accessing the data from PHP_AUTH_USER and PHP_AUTH_PW.
I'm not sure if this is still relevant, I'm talking years ago, but might be worth exploring?
Edit: Obviously I mean making an ajax request to the server that contains phpinfo on it after auth has been done. This would require a lingering phpinfo page on the server, but its actually more common than most people imagine.
Edit2: There might also be a play for a service worker and using fetch > https://developer.mozilla.org/en-US/docs/Web/API/Request
Thanks for reply.
Is an asp.net web application, with most pages written in asp classic. Plesk is installed, so php works. But i dont think there is a phpinfo page.
Can you make me an example for service worker?
RE: XSS steal basic auth - Tessaiga88 - Aug 5, 2021
After a lot of test, i can says there is no way to steal Request headers with javascript.
https://developer.mozilla.org/en-US/docs/Web/API/Request/headers
These API work for setting up headers for a new request. Or get them if you haved assigned one by ".append". You cant read headers assigned by your browser.