{"id":100,"date":"2023-01-14T14:47:58","date_gmt":"2023-01-14T14:47:58","guid":{"rendered":"https:\/\/thered0ne.com\/?p=100"},"modified":"2025-12-29T19:40:39","modified_gmt":"2025-12-29T19:40:39","slug":"bugpoc-challenge-4-wacky-xss","status":"publish","type":"post","link":"https:\/\/thered0ne.com\/?p=100","title":{"rendered":"BugPOC Challenge #4 – Wacky XSS"},"content":{"rendered":"
\n
\"\"<\/figure>\n<\/div>\n\n\n

$ Introduction:<\/h2>\n\n\n\n

Here we are again !! BugPOC team doesn’t stop impressing us by their commitment. Last time, we dealt with a local file inclusion (LFI). This time, a new XSS challenge made with love. This one is close enough to the real world of bug bounty, and it’s worth it. A place where you could step up your game. Without further ado, let’s go straightaway to the challenge.<\/p>\n\n\n\n

<\/p>\n\n\n\n

$ Goals:<\/h2>\n\n\n\n

We have to fire a popup showing ” Wacky.buggywebsite.com<\/strong>” and to achieve that goal we will use these techniques during the challenge:<\/p>\n\n\n\n

1- Find the reflection point in the website<\/p>\n\n\n\n

2- Bypass CSP (Content-security-policy).<\/p>\n\n\n\n

3- DOM Clobbering.<\/p>\n\n\n\n

4- Escape iFrame Sandbox.<\/p>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

$ Wacky website:<\/h2>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

At first glance, we could see that there are two sections, in this page:<\/p>\n\n\n\n

1- A text input with a submit button.<\/p>\n\n\n\n

2- An iFrame that serves as an output for our text. <\/p>\n\n\n\n

Let’s look at the source code to understand how it works:<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

The ” index<\/strong>” page does contain a call to another page called ” frame.html<\/strong>” which takes our input and process it.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

In the red box, we can see the function ” makeRandom<\/strong>” which is responsible for changing our input given to the ” frame.html<\/strong>” page. Maybe you’re saying that the vulnerable part in this page is the ” innerHTML<\/strong>” at the end of the first loop. It’s not !! Take a closer look if you want, each character is taken and put between a span tag to change its rendering, there’s no way to exploit that function. <\/p>\n\n\n\n

In the blue box, there are all the magical stuff that doesn’t allow you to execute your Javascript. We will get back to that soon.<\/p>\n\n\n\n

So, if the ” makeRandom<\/strong>” function is not the vulnerable entry, where is it then ?<\/p>\n\n\n\n

To be sure of that, we have to check if our input is reflected somewhere in the page, and I did find two places where there are a reflection:<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

To know the vulnerable point from these two code sections, all we have to do is to inject some html tags in the input and see which code part does sanitize\/escape the html tags and which does not …<\/p>\n\n\n\n

To try that out, we have to find a way to pass our payload to ” frame.html<\/strong>” page, since the special characters are forbidden [&%< >] <\/strong>and deleted dynamically by the ” script.js<\/strong>” file in the main page. (See below images)<\/p>\n\n\n\n

<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

So, let’s use the console tab in “developer mode”<\/strong> and make a redirection to ” frame.html<\/strong>” page like this:<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

The page doesn’t allow us to send content to the ” iframe<\/strong>“. Interesting, let’s go back and check the code: <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

As you can see, the ” window.name<\/strong>” has to be equal to ” iframe<\/strong>” or an error message is written in the iframe <\/strong>body.<\/p>\n\n\n\n

There is a technique I’ve seen recently on a Youtube video from   LiveOverflow<\/a> <\/strong>. By the way, I recommend to subscribe to this channel, you won’t regret it \u270c\ud83d\ude09 <\/p>\n\n\n\n

The guy is explaining the role of ” window.name”<\/strong> variable and what’s special about it. He added:<\/p>\n\n\n\n

\n

<\/p>\nThe “window.name” property gets\/sets the name of window’s browsing context<\/em><\/cite><\/blockquote>\n\n\n\n

The browsing context is the window tab. This allows the ” window.name<\/strong>” to persist across websites in the same window tab. So, setting ” window.name<\/strong>” to ” iframe<\/strong>” and going to another website (which will be ” wacky.buggywebsite.com<\/a>“), the value of the variable will persist and will allow us to pass the first check. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The second thing that we can see in the above image is our reflected payload ” XSS Challenge<\/strong>“. Let’s see where is exactly not escaped:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

From the above two images, we conclude that the entry point to our XSS is in the head section and especially  the title tag.<\/p>\n\n\n\n

<\/p>\n\n\n\n

$ CSP Bypass:<\/h2>\n\n\n\n

Before we go blindly and try to execute an inline Javascript, maybe we have to check first the CSP applied to the website by vising  https:\/\/csp-evaluator.withgoogle.com\/<\/a><\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"
The ” script-src<\/strong>“, ” frame-src<\/strong>” are activated, which means that inline Javascript and external URLs are not permitted. However, we can see clearly ” base-uri<\/strong> ” is missing. The description made by the CSP evaluator is explicit:<\/figcaption><\/figure>\n\n\n\n
\n

<\/p>\nMissing “base-uri” allows the injection of base tags. They can be used to set the base URL for all relative (scripts).<\/em><\/cite><\/blockquote>\n\n\n\n

That’s a good news. So, if we could inject BASE tag, we could hijack all relative URLs scripts present on the page. By Searching for local scripts used in the ” frame.html<\/strong>“, I found just one:<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

All we have to do now, is to inject in the ” frame.html<\/strong>” a BASE tag that will point all relative scripts URLs to our controlled server. So, let’s try to call our script.<\/p>\n\n\n\n

Funny fact:<\/strong> The reason behind why I chose particularly the image put in the title is by seeing this BugPOC third hint;  t<\/strong>hat was a funny unique hint \ud83d\ude02<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

First, we have to create the same file with the same path in our server. See the image below:<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

The ” frame-analytics.js<\/strong>” file contains this line of code:<\/p>\n\n\n\n

<\/circle><\/circle><\/circle><\/g><\/svg><\/span>