If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)

Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

Stored XSS in Boards.ie

900913 · 2012-03-24 19:23:17

Oops! I accidentally added a stored XSS to boards.ie. I made the post on the 18/3/2012 and while browsing boards I got an alert(1) pop up. I'll report it to a mod before posting the url: Any mods online pm me...

Options

24-03-2012 8:23pm

#1
900913

Registered Users Posts: 367 ✭✭

Join Date: March 2011

Posts: 310
Oops! I accidentally added a stored XSS to boards.ie.

I made the post on the 18/3/2012 and while browsing boards I got an alert(1)
pop up.

I'll report it to a mod before posting the url:

Any mods online pm me...

Tagged:

stored xss

0

Comments

Options
#2 24-03-2012 8:42pm
900913

Registered Users Posts: 367 ✭✭

Join Date: March 2011

Posts: 310

0
Options
#3 24-03-2012 11:05pm
900913

Registered Users Posts: 367 ✭✭

Join Date: March 2011

Posts: 310

bedlam wrote: »

Report it here

I reported it to MiCr0 who passed it on. But I didn't give any details about
which script of parameter is vulnerable.

0
Options
#4 24-03-2012 11:40pm
900913

Registered Users Posts: 367 ✭✭

Join Date: March 2011

Posts: 310

I just noticed that Damo2k had already reported this 4 days ago.
https://www.boards.ie/vbulletin/showthread.php?t=2056582381

There is also a reflected xss along with the stored xss.

On the Damo2k thread the title has been changed to "[Resolved] XSS"
When clearly it isn't.

0
Options
#5 24-03-2012 11:47pm
pacquiao

Closed Accounts Posts: 465 ✭✭

Join Date: January 2009

Posts: 387

900913 wrote: »

I just noticed that Damo2k had already reported this 4 days ago.
https://www.boards.ie/vbulletin/showthread.php?t=2056582381

There is also a reflected xss along with the stored xss.

On the Damo2k thread the title has been changed to "[Resolved] XSS"
When clearly it isn't.

you both found the same thing?

0
Options
#6 25-03-2012 12:14am
KoolKid

Moderators, Home & Garden Moderators, Technology & Internet Moderators Posts: 24,789 Mod ✭✭✭✭

Join Date: August 2006

Posts: 24128

I have flagged this for Admin attention.

0
Advertisement
Options
#7 25-03-2012 12:47am
Boards.ie: Danny

Closed Accounts Posts: 3,609 ✭✭✭

Join Date: October 2011

Posts: 3538

Hi there,

Thanks for the report about an XSS vulnerability here on Boards. Please forward all relevant details such as the script involved, your example post etc to the tech team via PM.

The tech team are:

Boards.ie: Ciaran
Boards.ie: Danny
Boards.ie: Neil
Boards.ie: Paddy
Boards.ie: Ronan

0
Options
#8 25-03-2012 7:10am
900913

Registered Users Posts: 367 ✭✭

Join Date: March 2011

Posts: 310
pacquiao wrote: »

you both found the same thing?

I cant really say we both found it cause for me it was more like I tripped over it.

I just clicked on ****** in boards.ie and while it was loading I went to a nother site I had opened. Next thing xss alert(1) pop-up.

I couldn't figure out which site it came from cause I had over 30 tabs open and I wasn't testing for xss. Then I opened the page source code for boards and seen my basic xss script (mods will probably delete this until hole is patched)
"/></Script><Script>alert(1)</Script>

Test code: "/></Script><Script>alert(1)</Script>
Test code 2:

"/></Script><Script>alert(1)</Script>

That when I realised it was a stored/persistent xss,dangerous stuff.

Arragh damo found it before me,(to be expected, the guys is a genius)

The admins deleted damo's thread in https://www.boards.ie/vbulletin/forumdisplay.php?f=228 probable because it the title was prefixed with the word Resolved. B]Resolved XSS[/B

Google cache of https://www.boards.ie/vbulletin/forumdisplay.php?f=228 before B]Resolved XSS[/B got removed.

They got it wrong but they are keen to fix/patch the vulnerability.

0
Options
#9 29-03-2012 1:12am
_AVALANCHE_

Closed Accounts Posts: 1,620 ✭✭✭

Join Date: December 2011

Posts: 1573

900913 wrote: »

What are all your browser addons?

Encode/Decode?
Proxies folder?
Other ones down bottom right corner?

0
Options
#10 29-03-2012 11:26am
900913

Registered Users Posts: 367 ✭✭

Join Date: March 2011

Posts: 310

The Proxies folder is just bookmarked proxies that I used to use.
The Hackery folder is a download from http://code.google.com/p/pentest-bookmarks/ full of pentest site bookmarks.

CryptoFox - https://addons.mozilla.org/en-US/firefox/addon/cryptofox/

Noscript - https://addons.mozilla.org/en-US/firefox/addon/noscript/

Adblock Plus - https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/

Phzilla proxy - https://addons.mozilla.org/en-US/firefox/addon/phzilla/

Xmarks - https://addons.mozilla.org/en-US/firefox/addon/xmarks-sync/

FoxyProxy - https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/

Server Spy - https://addons.mozilla.org/en-US/firefox/addon/server-spy/

Screen Grab - https://addons.mozilla.org/en-US/firefox/addon/screengrab/

FlagFox - https://addons.mozilla.org/en-US/firefox/addon/flagfox/

Cookies Manager+ 1.5.1 - https://addons.mozilla.org/en-US/firefox/addon/cookies-manager-plus/

Tab mix Plus - https://addons.mozilla.org/en-US/firefox/addon/tab-mix-plus/

Tamper Data - https://addons.mozilla.org/en-US/firefox/addon/tamper-data/

*edit

SecFox - Addons For Security Analysts/Pentesters
https://addons.mozilla.org/en-us/firefox/collections/rajivvishwa/secfox/

0
Options
#11 29-03-2012 10:11pm
_AVALANCHE_

Closed Accounts Posts: 1,620 ✭✭✭

Join Date: December 2011

Posts: 1573

Thanks for such a detailed response!:)

Do Phzilla and Foxy Proxy work well?

0
Advertisement
Options
#12 29-03-2012 10:20pm
_AVALANCHE_

Closed Accounts Posts: 1,620 ✭✭✭

Join Date: December 2011

Posts: 1573

900913 wrote: »

Server Spy - https://addons.mozilla.org/en-US/firefox/addon/server-spy/

Tamper Data - https://addons.mozilla.org/en-US/firefox/addon/tamper-data/

Do you work in this area? I'm guessing yes from reply in this Thread, complicated stuff.

0
Options
#13 29-03-2012 10:40pm
900913

Registered Users Posts: 367 ✭✭

Join Date: March 2011

Posts: 310

_AVALANCHE_ wrote: »

Do you work in this area? I'm guessing yes from reply in this Thread, complicated stuff.

??? Don't know what you mean. There's 1,000's of addons and tools better than the firefox addons listed.

I occasionally test the odd site and pass the flaws onto the site admins.

All Whitehat, Occasionally grey but never black.

Many site admins act offended when you give them info that proves there sites have vulnerabilities.

*edit
BTW I learned all this stuff online, from similar sites to them.

http://www.boards.ie/vbulletin/showpost.php?p=77585542&postcount=8

0