If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)

Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest

Stored XSS in Boards.ie

900913 · 2012-03-24 19:23:17

Oops! I accidentally added a stored XSS to boards.ie. I made the post on the 18/3/2012 and while browsing boards I got an alert(1) pop up. I'll report it to a mod before posting the url: Any mods online pm me...

24-03-2012 7:23pm

#1
900913

Registered Users, Registered Users 2 Posts: 367 ✭✭

Join Date: March 2011

Posts: 310
Oops! I accidentally added a stored XSS to boards.ie.

I made the post on the 18/3/2012 and while browsing boards I got an alert(1)
pop up.

I'll report it to a mod before posting the url:

Any mods online pm me...

Tagged:

stored xss

0

Comments

#2 24-03-2012 7:42pm

900913

Registered Users, Registered Users 2 Posts: 367 ✭✭

Join Date: March 2011

Posts: 310

0
#3 24-03-2012 10:05pm

900913

Registered Users, Registered Users 2 Posts: 367 ✭✭

Join Date: March 2011

Posts: 310

bedlam wrote: »

Report it here

I reported it to MiCr0 who passed it on. But I didn't give any details about
which script of parameter is vulnerable.

0
#4 24-03-2012 10:40pm

900913

Registered Users, Registered Users 2 Posts: 367 ✭✭

Join Date: March 2011

Posts: 310

I just noticed that Damo2k had already reported this 4 days ago.
https://www.boards.ie/vbulletin/showthread.php?t=2056582381

There is also a reflected xss along with the stored xss.

On the Damo2k thread the title has been changed to "[Resolved] XSS"
When clearly it isn't.

0
#5 24-03-2012 10:47pm

pacquiao

Closed Accounts Posts: 465 ✭✭

Join Date: January 2009

Posts: 387

900913 wrote: »

I just noticed that Damo2k had already reported this 4 days ago.
https://www.boards.ie/vbulletin/showthread.php?t=2056582381

There is also a reflected xss along with the stored xss.

On the Damo2k thread the title has been changed to "[Resolved] XSS"
When clearly it isn't.

you both found the same thing?

0
#6 24-03-2012 11:14pm

KoolKid

Moderators, Home & Garden Moderators, Technology & Internet Moderators Posts: 24,789 Mod ✭✭✭✭

Join Date: August 2006

Posts: 24128

I have flagged this for Admin attention.

0
Advertisement
#7 24-03-2012 11:47pm

Boards.ie: Danny

Closed Accounts Posts: 3,609 ✭✭✭

Join Date: October 2011

Posts: 3538

Hi there,

Thanks for the report about an XSS vulnerability here on Boards. Please forward all relevant details such as the script involved, your example post etc to the tech team via PM.

The tech team are:

Boards.ie: Ciaran
Boards.ie: Danny
Boards.ie: Neil
Boards.ie: Paddy
Boards.ie: Ronan

0
#8 25-03-2012 6:10am
900913

Registered Users, Registered Users 2 Posts: 367 ✭✭

Join Date: March 2011

Posts: 310
pacquiao wrote: »

you both found the same thing?

I cant really say we both found it cause for me it was more like I tripped over it.

I just clicked on ****** in boards.ie and while it was loading I went to a nother site I had opened. Next thing xss alert(1) pop-up.

I couldn't figure out which site it came from cause I had over 30 tabs open and I wasn't testing for xss. Then I opened the page source code for boards and seen my basic xss script (mods will probably delete this until hole is patched)
"/></Script><Script>alert(1)</Script>

Test code: "/></Script><Script>alert(1)</Script>
Test code 2:

"/></Script><Script>alert(1)</Script>

That when I realised it was a stored/persistent xss,dangerous stuff.

Arragh damo found it before me,(to be expected, the guys is a genius)

The admins deleted damo's thread in https://www.boards.ie/vbulletin/forumdisplay.php?f=228 probable because it the title was prefixed with the word Resolved. B]Resolved XSS[/B

Google cache of https://www.boards.ie/vbulletin/forumdisplay.php?f=228 before B]Resolved XSS[/B got removed.

They got it wrong but they are keen to fix/patch the vulnerability.

0
#9 29-03-2012 12:12am

_AVALANCHE_

Closed Accounts Posts: 1,620 ✭✭✭

Join Date: December 2011

Posts: 1573

900913 wrote: »

What are all your browser addons?

Encode/Decode?
Proxies folder?
Other ones down bottom right corner?

0
#10 29-03-2012 10:26am

900913

Registered Users, Registered Users 2 Posts: 367 ✭✭

Join Date: March 2011

Posts: 310

The Proxies folder is just bookmarked proxies that I used to use.
The Hackery folder is a download from http://code.google.com/p/pentest-bookmarks/ full of pentest site bookmarks.

CryptoFox - https://addons.mozilla.org/en-US/firefox/addon/cryptofox/

Noscript - https://addons.mozilla.org/en-US/firefox/addon/noscript/

Adblock Plus - https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/

Phzilla proxy - https://addons.mozilla.org/en-US/firefox/addon/phzilla/

Xmarks - https://addons.mozilla.org/en-US/firefox/addon/xmarks-sync/

FoxyProxy - https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/

Server Spy - https://addons.mozilla.org/en-US/firefox/addon/server-spy/

Screen Grab - https://addons.mozilla.org/en-US/firefox/addon/screengrab/

FlagFox - https://addons.mozilla.org/en-US/firefox/addon/flagfox/

Cookies Manager+ 1.5.1 - https://addons.mozilla.org/en-US/firefox/addon/cookies-manager-plus/

Tab mix Plus - https://addons.mozilla.org/en-US/firefox/addon/tab-mix-plus/

Tamper Data - https://addons.mozilla.org/en-US/firefox/addon/tamper-data/

*edit

SecFox - Addons For Security Analysts/Pentesters
https://addons.mozilla.org/en-us/firefox/collections/rajivvishwa/secfox/

0
#11 29-03-2012 9:11pm

_AVALANCHE_

Closed Accounts Posts: 1,620 ✭✭✭

Join Date: December 2011

Posts: 1573

Thanks for such a detailed response!:)

Do Phzilla and Foxy Proxy work well?

0
Advertisement
#12 29-03-2012 9:20pm

_AVALANCHE_

Closed Accounts Posts: 1,620 ✭✭✭

Join Date: December 2011

Posts: 1573

900913 wrote: »

Server Spy - https://addons.mozilla.org/en-US/firefox/addon/server-spy/

Tamper Data - https://addons.mozilla.org/en-US/firefox/addon/tamper-data/

Do you work in this area? I'm guessing yes from reply in this Thread, complicated stuff.

0
#13 29-03-2012 9:40pm

900913

Registered Users, Registered Users 2 Posts: 367 ✭✭

Join Date: March 2011

Posts: 310

_AVALANCHE_ wrote: »

Do you work in this area? I'm guessing yes from reply in this Thread, complicated stuff.

??? Don't know what you mean. There's 1,000's of addons and tools better than the firefox addons listed.

I occasionally test the odd site and pass the flaws onto the site admins.

All Whitehat, Occasionally grey but never black.

Many site admins act offended when you give them info that proves there sites have vulnerabilities.

*edit
BTW I learned all this stuff online, from similar sites to them.

http://www.boards.ie/vbulletin/showpost.php?p=77585542&postcount=8

0