[๖ۣۜCriminal]

http://kuza55.blogspot.com/2008/02/explo...d-xss.html

Using something like this may still work depending on how the session cookies work on minecrafts site.

[Im gone brah]

Sorry Haxxy baby, but are you dumb o.o?
I can make a link which on click auto-submits a POST request.
OP, got skype/xmpp?
If yes, PM me it.

No, that won't work at all. Rifk

[Gee4rce]

I can make a link which on click auto-submits a POST request.

This is true, but if the website i.e. has no other vulnerability (which you may could use in combination to auto-launch the XSS),
AND further is even CSRF protected, then there is no real chance for a propper exploitation.

Sorry Haxxy baby, but are you dumb o.o?

You not call HaxOr dumb mate... 😅 If he says something, then it has a reason.

No one done anything with it yet? Waiting for a big hax0r to get something done

So why not do something by your own?

Greets, Gee.

[ThePenumbra]

No, that won't work at all. Rifk

Why not?

This is true, but if the website i.e. has no other vulnerability (which you may could use in combination to auto-launch the XSS),
AND further is even CSRF protected, then there is no real chance for a propper exploitation.

Why do you need another vulnerability?
If you have a proper POST XSS without csrf protection in it, you can just upload html with js on another site. You dont need to get the response, you just need to make the request.

[Gee4rce]

Why do you need another vulnerability?

As for this one, there was a CSRF protection.
So as long as you not find another vulnerability, this XSS alone is not pretty much to exploit something interesting from it.

You dont need to get the response, you just need to make the request.

You must be new here, calling HaxOr dumb and explaining me how XSS works 😅
(it's ok though, no problem ;)

Greets, Gee.

[ThePenumbra]

As for this one, there was a CSRF protection.
So as long as you not find another vulnerability, this XSS alone is not pretty much to exploit something interesting from it.

You must be new here, calling HaxOr dumb and explaining me how XSS works 😅
(it's ok though, no problem ;)

Greets, Gee.

If you take a look at my previous post in this thread, I said I didnt notice the CSRF protection.

[Gee4rce]

Yes, sure,
but if you also take a look at your pre-previous post, you stated "Why do you need another vulnerability?", so i just explained why i put this statement before.
But np, lets move on here and get back to the topic guys...
Greets, Gee.

[Im gone brah]

Why not?

Are you for real, last time I checked this is not possible due to CSRF protection mechanism. Prove me wrong and I'd be happy to change my opinion. I'd also like to state that this XSS vulnerability is pretty much limited and really useless. Edit: If you want feel proudly with piping alerts, I won't stop you.

[LevelUp]

You realise you can just use the XSS to extract the token using javascript right? Why are people crying over the token being some kind of ultimate protection?

It's 2015 now, step it up guys.

[Gee4rce]

You realise you can just use the XSS to extract the token using javascript right? Why are people crying over the token being some kind of ultimate protection?

It's 2015 now, step it up guys.

Nice to see you back LevelUp!!
But looks like you was sleeping while writing your answer 😅 ->
how would you extract the session or CSRF token, if the CSRF token already prevents an attacker from launching the XSS 'remotely' ? ...(as that would be required to extract anything Session related)
Greets, Gee.

[LevelUp]

Nice to see you back LevelUp!!
But looks like you was sleeping while writing your answer 😅 ->
how would you extract the session or CSRF token, if the CSRF token already prevents an attacker from launching the XSS 'remotely' ? ...(as that would be required to extract anything Session related)
Greets, Gee.

To leave you wanting more I suggest you look into the Sammy Worm which used javascript to bypass myspace anti-csrf, but I wasn't sleeping.

Quick edit: Because I don't think any of you will actually bother looking into that you can just go on Owasp and it will set you straight.

[Gee4rce]

He was able to bypass CSRF because he got a persistent XSS that was running on the MySpace domain

^ Thats what i tried to explain LevelUp, OP's scenario is just a reflected POST XSS, thus it will not work extracting stuff.

[Cathal]

To leave you wanting more I suggest you look into the Sammy Worm which used javascript to bypass myspace anti-csrf, but I wasn't sleeping.

Quick edit: Because I don't think any of you will actually bother looking into that you can just go on Owasp and it will set you straight.

Leaving this here in the hopes LevelUp sees it. I can't PM you at the moment, gimme a buzz when you're round.