czwartek, 19 grudnia 2013

Yandex Metrica multiple XSS vulnerabilities

Ok, some time ago I found few XSS vulnerabilities at one of Yandex services called Metrika.. Most are fixed now, so I can provide Proof Of Concepts publicly. :)

1) Reflected XSS - [somewhere]

(this one is still not fixed so - it will be disclosed in future, but it's nothing special really)

2) Stored XSS - external links

Demonstration video is quite long because I was creating PoC while recording. ;-)

http://www.youtube.com/watch?v=ZhNn0uYXpL8

3) Stored XSS - WebVisior

Visiting your website with Metrica counter in this way:

http://hostname/x.htm?<img/src="XXX"/onerror="alert(1)">ab

causes that Metrica WebVisior rendered it without escaping, which is just another stored XSS.














4) Stored XSS - file downloads

http://www.youtube.com/watch?v=4xgcjisyzK8

5) Stored XSS - Clickpath analysis

http://www.youtube.com/watch?v=SqTSoCd86Sk

6) Reflected XSS - Form Data analysis

http://www.youtube.com/watch?v=LALvffnT-vQ

7) *BONUS* out of scope (so unrewarded) reflected XSS in yandex.st.

http://yandex.st/mail/neo2/7.35.2005/static/swf/web-socket.swf?onLoad=this.alert('XSS')

Effect + source code:


And that's all for today. :)

12 komentarzy:

  1. What a fantabulous post this has been. Never seen this kind of useful post. I am grateful to you and expect more number of posts like these. Thank you very much.

    Download Full Movie

    the family man 2019 480p download

    OdpowiedzUsuń
  2. This is one of the best post i have read in months, its really great and inspiring, i will really like to read more form you and will like to share with others as well, keep writing more
    Buy Weed Seeds Online
    Buy A-796,260 Online
    Buy Phenethylamine Psychedelics online
    Subutex 8mg Online
    Order Quaaludes Mandrax 300mg online
    Buy DMT Dimethyltryptamine Online
    Valium Diazepam For Sale Online
    Buy Harvoni ledipasvir sofosbuvir online
    Cannabis Oil For Sale
    Buy enzodiazepines online you can as well Whatsapp/Text +1(646)883-3072 , Telegram: primenature or email:primepharma0@gmail.com for more details.

    دانلود موزیک
    هوروش باند

    پازل باند

    رضا شیری

    OdpowiedzUsuń
  3. The Collection Marts is platform where you can view latest designs about home décor and bedding. We have large range in different categories with finest fabric in cotton and silk. You can view not only present trends but also view huge collection with reasonable price. The Collection Marts can provide fast service about delivery as well as customer support too. Our products are not only self-made but also, well connected with markets to ensure for possibility of available designs if client want to purchase. The Collection Marts customer support open 24/7 to guide their customers about material or product stuff. cotton sheet sets on sale , comforter only , cotton bed sheets online , fancy nancy sheet set , bedroom duvet sets , razai bed sheet , covering a sofa with fabric , crushed velvet bed sheets , razai cover online , 100% cotton bath towels

    OdpowiedzUsuń
  4. Many people try to buy Pentobarbital Sodium online, but never receive it because most of the online sellers are scammers and also because the drug is introduced captured by the authorities. We are in the peaceful resolution to provide information life options. We are the leaders in the elections at the end of life Euthanasia / assisted suicide) of the information and the defense community. We have other medications, although they are not mentioned in the previous list.

    Contact For More Details

    Email-: gransuministros.medicine@gmail.com
    Whatsapp +1 530-517-7417

    OdpowiedzUsuń
  5. Thank you.

    ย้ำกันอีกครั้ง เว็บดูหนังออนไลน์ฟรีที่นี่

    เรามีให้คุณได้ดูกันอย่างสนุกสะใจ และสนใจบริการไหนอย่ารอช้า สอบถามกันได้ที่นี่เรามีทั้งบริการเว็บดูหนังออนไลน์ซีรี่ย์ออนไลน์ให้คุณดูทุกรูปแบบ และไม่ว่าคุณจะอยู่ที่ไหนมาสนุกกับเราได้ต่อเนื่องตลอด 24 ชั่วโมง ค้นหาความสะดวกกับการรับชมความบันเทิงผ่านระบบออนไลน์ มีให้คุณที่นี่ตลอด 24 ชั่วโมงแน่นอนสะดวกบริการเด็ดๆบริการหนังดีๆเสียงภาษาไทยเสียงซาวด์แทร็กมีครบ ย้ำว่าฟรีแน่นอนสะดวกทุกทีเข้าเว็บดูหนังออนไลน์ดีๆ ได้ทั้งวันต้องที่นี่

    OdpowiedzUsuń
  6. The Indian government and the railway department have the biggest task to ensure each employee gets their salary. The allowances and monthly payslip 2020-2021-2022. Considering the number of employees. This seems like a big challenge for the railway accounting department. AIMS Indian Railway Employee Online Registration 2023 However, the railway department and the Indian government have introduced a new and reliable online system.

    OdpowiedzUsuń
  7. 由于假冒供应商,在哪里在线购买戊巴比妥液体戊巴比妥现在是一个问题。

    不仅在网上购买戊巴比妥液体是一个问题,而且对于许多正在寻找真正可靠的供应商的人来说,购买戊巴比妥(粉末、丸剂、液体和注射剂)也是一个衡量问题。

    许多人因为试图寻找诚实的戊巴比妥供应商而被骗。 有些人认为戊巴比妥已经不存在了,因为他们在网上购买戊巴比妥液体时多次被骗。

    戊巴比妥钠液体确实存在,并且只有少数供应商可以出售,当然我们是其中之一。

    戊巴比妥戊巴比妥钠溶液指令:
    -这是一个非常简单的过程。
    - 在饮用戊巴比妥钠溶液之前,先将止吐药与水一起服用。
    - 打开前请摇匀瓶子,倒入玻璃杯中,然后立即饮用。

    -饮用戊巴比妥钠溶液后,15至20分钟内进入深度睡眠,并在20至35分钟内平静地死亡,没有任何痛苦,也没有呕吐。 和平自杀是一个快速的过程。

    戊巴比妥戊巴比妥口服液是我们实验室研究和生产的。 我们为其 100% 的纯度和有效性感到自豪,立即订购并通过最安全的方式将其运送到世界各地。

    我们为您提供三种形式的戊巴比妥药物——粉末、液体和片剂。 如果您对剂量数或最佳服药方式有任何疑问,可以联系我们。

    Whats-App +447958552302

    电子邮件地址:……..stevealder579@gmail.com

    OdpowiedzUsuń