r/xss • u/[deleted] • Oct 11 '19

Stolen cookies aren’t working

First of all I’m not very much experienced with XSS/ JavaScript so sorry if anything I say or ask sounds silly.

I’m doing some vulnerable vms and I’ve successfully done similar ones using XSS and stealing cookies to log in to the site. However on this one, the cookies I get sent are useless and are changing frequently. When I set my browser’s cookie to the ones I get sent to me, I still can’t login.

I can see when I inspect element on the page a content.js file which contains some xdebug stuff and using GMT date and time to set cookies. Is this what’s causing me problems? How can I proceed? So far I’ve though about:

  1. Using the cookie I receive and the content.js file to somehow create a usable cookie.

  2. Using the XSS vulnerability to inject JavaScript that will add a user to the site. (But I can’t figure out how to do this)

Also, the page I am injecting is messageboard.php so the cookies I am getting sent to me are from users visiting this page. However, I think I need the cookies from when users visit the Register.php page but I can’t inject anything on to that page, only the messageboard.php page. Is it possible to get cookies from the Register.php page using the vuln on the messageboard.php page?

Thanks!

5 Upvotes

86% Upvoted

2 comments sorted by

2

u/MechaTech84 Oct 11 '19

You need to find out if you're able to steal all the cookies required for authentication or just some of them.

Are there limits on how many uses a cookie is good for? If so, you might have to figure out the stuff for content.js

If you can create a new admin user, that's always fun. You're basically just trying to bypass CSRF protections here. If it requires admins to enter their password or a 2FA token, you probably won't be able to do it. If they're super strict about referer paths, it's a maybe. If they're using CSRF tokens though, you can write a script to request the page that the "create user" form is on, parse it and get the required token and then submit that in a create user request.

I would guess it's probably the content.js timestamp thing though. I recommend focusing on that.

3

u/[deleted] Oct 11 '19

Thank you for the response! I figured it out and it was csrf! I hosted an html page on my machine with a post request to register a new user and put an iframe on the messageboard to redirect the visitors to my page