Webverselabs Milltrace Challenge XSS

Solution :

Millrace is a microbrewery and taproom that hosts live music. Their homepage has a tiny debug pane echoing the visitor’s user-agent into an HTML comment for troubleshooting. The /debug page lets anyone set their session-scoped UA to any string they like. You can see the problem from here.

Solution :

We first start by browsing the application like a normal user would, to check different endpoints and try to find where we can inject.

/Pours :

Nothing useful here , just a List of Beer names.

/Events :

This isn’t useful either , just a static web page showing us different planned events .

/Tour :

Just a static web page, nothing useful here either :)

/Debug :

This time we find an injection spot finally :)

First thing we should try is use it normally then check both the front end code as well as Burp’s History to see how our request is being processed by the server .

If we check the front end code :

We see that our payload gets URL encoded , and stored , let’s go back to the Dashboard :

We see that the payload is being rendered back to us -_- , let’s check the front code again :

For whatever reason it is rendered back to us as an HTML comment , we can simply try to break out of it by ending the comment before our payload :

--> <script>alert(window.origin)</script>

Let’s try this one :

Now if we go back to the Dashboard , hopefully our JS is executed .

And it is executed , from there we just get the flag :

If we check the front end code one last time , we can see that we were able to break out of the HTML comment :

That was all for this challenge . See you in the next one :)