This exercise starts out having you search the page for a
URL that could have some XXS vulnerability via an ajax call. Even though I had some exposure to how AJAX
works in the last exercise I had a lot of trouble finding a place to insert
java script within the different urls generated by the site. After checking the
first hint it pointed me in the direction of the user snippit page and the url
that looks like: http://google-gruyere.appspot.com/455011419358/feed.gtl?uid=value
After playing with the url I found that you can insert
script tags at the end to get XXS when the page is refreshed. This is possible
because the Jason being sent back and forth is not escaping JavaScript
characters with the Javascript escapes \x3c and \x3e. Overall I
found the XXS section very interesting but it would have been more helpful if I
installed burp before I started on the exercises because I would be able to see
what the site is sending back to the server and the servers response.
No comments:
Post a Comment