search

psiinon / bodgeit

The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing.
263 stars 195 forks source link

Additional XSS attack in contact.jsp not counted as passed challenge -- XSS in contact.js #19

Open julianthome opened 6 years ago

julianthome commented 6 years ago

It is possible to run a XSS attack through the contact.jsp servlet that allows attackers to run arbitrary javascript code on the contact.jsp page itself and on admin.jsp.

  1. Go to contact.jsp as guest user
  2. Switch on network traffic recording (through your browser or proxy)
  3. Click the submit button
  4. Change both the null and comments fields to %3CScript%3Ealert%28%27hello%27%29%3B%3C%2FScript%3E (e.g. null=%3CScript%3Ealert%28%27hello%27%29%3B%3C%2FScript%3E&anticsrf=0.33839068496777436&comments=%3CScript%3Ealert%28%27hello%27%29%3B%3C%2FScript%3Enull=%3CScript%3Ealert%28%27hello%27%29%3B%3C%2FScript%3E&anticsrf=0.33839068496777436&comments=%3CScript%3Ealert%28%27hello%27%29%3B%3C%2FScript%3E).
  5. Login as admin user
  6. Two pop-up boxes with the text hello should be displayed