[The2G]

Hi mates,

I recently found a XSS Vulnerable website, that allows me to execute JS code... Since I know JS is executed client-side and is no way to modify the server-side.

My first idea (what I just tried) was to upload an php payload to get remote shell. I created that payload with MSF. But can't execute it because can't upload it to the server. Any idea of what can I do, or if it is possible to upload that payload vía JS?


Thanks!

[Hoodie+]

It's client side.

Try stealing cookies,, that's mostly it.

[The2G]

It's client side.

Try stealing cookies,, that's mostly it.

Thanks! Would try it.

[redlightrouter]

Like you said Javascript is client-side. What you're wanting to accomplish is server-side.

[The2G]

Like you said Javascript is client-side. What you're wanting to accomplish is server-side.

So I guess first I need to somehow get access or upload my shell to the server... I think that need to read/learn a bit more 👍