1c:I[73356,["10933","static/chunks/10933-713dc1c0b1561380.js","94937","static/chunks/94937-3f819e5ef7dfa8a0.js","9131","static/chunks/9131-9372417797d59026.js","98244","static/chunks/98244-037342d518451489.js","6342","static/chunks/6342-5661a6a2702af160.js","27689","static/chunks/27689-8d5be78f17754629.js","34877","static/chunks/app/(marketing)/blog/%5Bslug%5D/page-ee27fea45c92c1b5.js"],"BlogArticleEnhancements"] 1d:I[53721,["10933","static/chunks/10933-713dc1c0b1561380.js","94937","static/chunks/94937-3f819e5ef7dfa8a0.js","9131","static/chunks/9131-9372417797d59026.js","98244","static/chunks/98244-037342d518451489.js","6342","static/chunks/6342-5661a6a2702af160.js","27689","static/chunks/27689-8d5be78f17754629.js","34877","static/chunks/app/(marketing)/blog/%5Bslug%5D/page-ee27fea45c92c1b5.js"],"BlogViewTracker"] 1f:I[97042,["10933","static/chunks/10933-713dc1c0b1561380.js","94937","static/chunks/94937-3f819e5ef7dfa8a0.js","9131","static/chunks/9131-9372417797d59026.js","98244","static/chunks/98244-037342d518451489.js","6342","static/chunks/6342-5661a6a2702af160.js","27689","static/chunks/27689-8d5be78f17754629.js","34877","static/chunks/app/(marketing)/blog/%5Bslug%5D/page-ee27fea45c92c1b5.js"],"BlogToc"] 24:I[54324,[],"IconMark"] :HL["https://codelivly.com/wp-content/uploads/2023/03/blind-xss-1536x1014-1.jpg","image"] 20:T14e5,

In this article, we will discuss how a bug hunter received a bounty of $3000 on his finding on Blind & Stored Cross-Site Scripting (XSS), and how you can reproduce.

Blind XSS vulnerabilities are a variant of persistent XSS vulnerabilities. They occur when the attacker input is saved by the web server and executed as a malicious script in another part of the application or in another application.

For example, an attacker injects a malicious payload into a contact/feedback page and when the administrator of the application is reviewing the feedback entries the attacker’s payload will be loaded.

The attacker input can be executed in a completely different application (for example an internal application where the administrator reviews the access logs or the application exceptions).

These are the wild places you should target when finding Blind XSS during bug hunting, they contain Blind XSS vulnerabilities.

Contact/Feedback pages
Log viewers
Exception handlers
Chat applications / forums
Customer ticket applications
Web Application Firewalls
Any application that requires user moderation

What is Stored Cross-Site Scripting?

Stored cross-site scripting (also known as second-order or persistent XSS) arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way.
If an attacker can control a script that is executed in the victim’s browser, then they can typically fully compromise that user.

The location of the stored data within the application’s response determines what type of payload is required to exploit it and might also affect the impact of the vulnerability.

Entry Points to Look Out In Hunting Stored XSS

Parameters or other data within the URL query string and message body.
The URL file path.
HTTP request headers that might not be exploitable in relation to reflected XSS.
Any out-of-band routes via which an attacker can deliver data into the application.

Steps to Reproduce

In the xsspoc.txt you can also see that the employee used some kind of intranet website that is not accessible through internet (https://██████████.tapiola .fi/a2/VerkaFileLoaderWeb/rest/files/30fe1c28-4c4f-4f2c-bb3c-eae59ec7b42c).

The following cookies were stolen and can be viewed in the xsspoc.txt

Proof of Exploitation

The file is from the attacker’s Nginx-server logs and in the file you can see that a Lahitapiola employee (notice the IP-address) has opened attachments and triggered the XSS which sent the employees cookies to the attacker’s server.

Summary

The reporter/attacker was able to perform a Blind-Stored XSS against the secure messaging system for LocalTapiola customers.

It occurs when the data provided by the attacker is saved by the server, and then permanently displayed on “normal” pages returned to other users.

Thank you very much for your time and I wish you good luck in your bug hunting.

9:[["$","$L1c",null,{}],["$","$L1d",null,{"slug":"blind-stored-cross-site-scripting-xss-generic-bug-bounty-report"}],"$L1e",["$","div",null,{"className":"mx-auto max-w-6xl px-4 py-10 sm:px-6 sm:py-12","children":["$","div",null,{"className":"lg:grid lg:grid-cols-[minmax(0,1fr)_320px] lg:gap-10 xl:gap-12","children":[["$","article",null,{"id":"blog-content","className":"blog-content min-w-0 max-w-3xl","children":[["$","nav",null,{"className":"font-mono mb-6 text-xs text-[var(--hm-muted)]","children":[["$","$L1a",null,{"href":"/","className":"text-[var(--hm-muted)] no-underline hover:text-[var(--hm-mint)]","children":"Home"}],["$","span",null,{"className":"mx-2","children":"/"}],["$","$L1a",null,{"href":"/blog","className":"text-[var(--hm-muted)] no-underline hover:text-[var(--hm-mint)]","children":"Blog"}],["$","span",null,{"className":"mx-2","children":"/"}],["$","span",null,{"className":"text-[var(--hm-text)]","children":"Blind & Stored Cross-site Scripting (XSS) – Generic Bug Bounty Report"}]]}],["$","header",null,{"className":"mb-8","children":[["$","div",null,{"className":"mb-6 overflow-hidden rounded-[2px] border border-[var(--hm-border)]","children":["$","img",null,{"src":"https://codelivly.com/wp-content/uploads/2023/03/blind-xss-1536x1014-1.jpg","alt":"Blind & Stored Cross-site Scripting (XSS) – Generic Bug Bounty Report","className":"aspect-[16/9] w-full object-cover"}]}],["$","div",null,{"className":"mb-4 flex flex-wrap gap-2","children":[["$","span",null,{"className":"font-mono rounded-[2px] border border-[var(--hm-mint)]/30 bg-[var(--hm-mint)]/10 px-2.5 py-1 text-[11px] uppercase tracking-wider text-[var(--hm-mint)]","children":"Bug Bounty"}],[]]}],["$","h1",null,{"className":"font-display text-3xl font-bold leading-tight tracking-[-0.01em] text-[var(--hm-text-strong)] sm:text-[2.5rem]","children":"Blind & Stored Cross-site Scripting (XSS) – Generic Bug Bounty Report"}],["$","p",null,{"className":"mt-4 text-base leading-relaxed text-[var(--hm-muted)]","children":"In this article, we will discuss how a bug hunter received a bounty of $3000 on his finding on Blind Stored Cross-Site Scripting (XSS), and how you can reproduce. What is Blind Cross-Site Scripting? B"}],["$","div",null,{"className":"mt-5 flex flex-wrap items-center gap-x-3 gap-y-2 border-t border-[var(--hm-border)] pt-5 font-mono text-xs text-[var(--hm-muted)]","children":[["$","span",null,{"className":"flex items-center gap-2","children":[["$","span",null,{"aria-hidden":true,"className":"flex h-7 w-7 items-center justify-center rounded-full border border-[var(--hm-ring)] bg-[rgba(0,230,118,0.08)] text-[11px] font-bold text-[var(--hm-mint)]","children":"R"}],["$","span",null,{"className":"text-[var(--hm-text)]","children":"rocky"}]]}],["$","span",null,{"aria-hidden":true,"children":"·"}],["$","time",null,{"dateTime":"2023-03-14T20:14:07.000Z","children":"Mar 14, 2023"}],[["$","span",null,{"aria-hidden":true,"children":"·"}],["$","span",null,{"children":[3," min read"]}]]]}]]}],["$","$L1f",null,{"items":[{"id":"what-is-blind-cross-site-scripting","text":"What is Blind Cross-Site Scripting?","depth":1},{"id":"example-of-webnbspapplications-amp-web-pages-where-blind-xssnbspattacks-can-occur","text":"Example of Web Applications & Web Pages Where Blind XSS Attacks Can Occur","depth":1},{"id":"what-is-stored-cross-site-scripting","text":"What is Stored Cross-Site Scripting?","depth":1},{"id":"entry-points-to-look-out-in-hunting-stored-xss","text":"Entry Points to Look Out In Hunting Stored XSS","depth":1},{"id":"steps-to-reproduce","text":"Steps to Reproduce","depth":1},{"id":"proof-of-exploitation","text":"Proof of Exploitation","depth":1},{"id":"summary","text":"Summary","depth":1}]}],["$","div",null,{"className":"blog-prose text-base leading-relaxed text-[var(--hm-text)]","children":["$","div",null,{"dangerouslySetInnerHTML":{"__html":"$20"}}]}],false,"$L21","$L22"]}],"$L23"]}]}]] c:null 11:[["$","title","0",{"children":"Blind & Stored Cross-site Scripting (XSS) – Generic Bug…"}],["$","meta","1",{"name":"description","content":"In this article, we will discuss how a bug hunter received a bounty of $3000 on his finding on Blind Stored Cross-Site Scripting (XSS), and how you can…"}],["$","meta","2",{"name":"author","content":"Codelivly Team"}],["$","meta","3",{"name":"creator","content":"Codelivly"}],["$","meta","4",{"name":"publisher","content":"Codelivly"}],["$","meta","5",{"name":"robots","content":"index, follow"}],["$","link","6",{"rel":"canonical","href":"https://codelivly.com/blind-stored-cross-site-scripting-xss-generic-bug-bounty-report"}],["$","link","7",{"rel":"alternate","hrefLang":"en-US","href":"https://codelivly.com/blind-stored-cross-site-scripting-xss-generic-bug-bounty-report"}],["$","meta","8",{"property":"og:title","content":"Blind & Stored Cross-site Scripting (XSS) – Generic Bug…"}],["$","meta","9",{"property":"og:description","content":"In this article, we will discuss how a bug hunter received a bounty of $3000 on his finding on Blind Stored Cross-Site Scripting (XSS), and how you can…"}],["$","meta","10",{"property":"og:url","content":"https://codelivly.com/blind-stored-cross-site-scripting-xss-generic-bug-bounty-report"}],["$","meta","11",{"property":"og:site_name","content":"Codelivly"}],["$","meta","12",{"property":"og:locale","content":"en_US"}],["$","meta","13",{"property":"og:image","content":"https://codelivly.com/wp-content/uploads/2023/03/blind-xss-1536x1014-1.jpg"}],["$","meta","14",{"property":"og:image:width","content":"1200"}],["$","meta","15",{"property":"og:image:height","content":"630"}],["$","meta","16",{"property":"og:type","content":"article"}],["$","meta","17",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","18",{"name":"twitter:creator","content":"@codelivly"}],["$","meta","19",{"name":"twitter:title","content":"Blind & Stored Cross-site Scripting (XSS) – Generic Bug…"}],["$","meta","20",{"name":"twitter:description","content":"In this article, we will discuss how a bug hunter received a bounty of $3000 on his finding on Blind Stored Cross-Site Scripting (XSS), and how you can…"}],["$","meta","21",{"name":"twitter:image","content":"https://codelivly.com/wp-content/uploads/2023/03/blind-xss-1536x1014-1.jpg"}],["$","link","22",{"rel":"shortcut icon","href":"/favicon.svg"}],["$","link","23",{"rel":"icon","href":"/favicon.svg"}],["$","link","24",{"rel":"apple-touch-icon","href":"/favicon.svg"}],["$","$L24","25",{}]]