Webverselabs Challenge Sprocket-Line- Reflected XSS

Scenario :

After a phishing near-miss, Sprocket Line’s owner hired someone to “add security.” He got one line of PHP that strips

Solution :

We first start by navigating the application just like a normal user, check different endpoints and features, we’re mainly looking for a spot to inject .

/Parts :

Just a static page showing us different products, nothing useful .

/Warranty :

Another static page , nothing useful for us :)

/Fit Calc :

Finally somewhere we can inject , first let’s send a normal request and check burp .

Just a simple GET request containing our parameter , and returning whatever we inserted back to us , let’s first try to inject a simple XSS payload :

<script>alert(window.origin)</script>

We see that our tags are removed automatically , and we only get the content inside of them reflected back to us . Maybe there is a filter for script tag, whenever we suspect that there is a filter for specific tags , we can try and use this list of Bypasses :

https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html

For this one , any of the Bypasses should work since this is a pretty simple one :

I choosed this one :

<a href="jav&#x0D;ascript:alert('XSS');">Click Me</a>

Make sure you URL encode everything if you have space in your payload since the field doesn’t allow spaces .

If you can’t insert the payload directly :

Just insert anything and then intercept the request :

From there modify the request before forwarding it to the server :

Now if we go back to the app :

We see that our code was indeed executed , now if we click the “Click Me “ Botton , we fire our XSS .

Once the XSS is triggered we should get our flag :

That was all for this challenge. See you in the next one :)