HTML Injection + XSS Vulnerability - https://████████/ | Proof of Concept [PoC]

How it was found

Hello U.S. Dept Of Defense Security Team,

My name is Ismail Tasdelen. As a security researcher. I found a html injection and xss vulnerability.

Url address : https://█████████/

HTML Injection + XSS Payload = html+injection+xss"><h1><marquee>Ismail Tasdelen</marquee></h1><img src=x onerror=alert("ismailtasdelen")>

Descripton :

The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed in this manner constitute the core of many phishing schemes, whereby an attacker convinces a victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's content back to the victim, the content is executed by the victim's browser.

References :

• https://cwe.mitre.org/data/definitions/79.html
• https://portswigger.net/web-security/cross-site-scripting

Step by step :

• https://██████████/ got to.
• Run HTML Injection + XSS Payload in the search field.

Thanks

Impact

Impact of XSS vulnerabilities :

An attacker who exploits a cross-site scripting vulnerability is typically able to:

• Impersonate or masquerade as the victim user.
• Carry out any action that the user is able to perform.
• Read any data that the user is able to access.
• Capture the user's login credentials.
• Perform virtual defacement of the web site.
• Inject trojan functionality into the web site.

The actual impact of the attack generally depends on the nature of the application, its functionality and data, and the status of the compromised user. For example:

• In a brochureware application, where all users are anonymous and all information is public, the impact will often be minimal.
• In an application holding sensitive data, such as banking transactions, emails, or healthcare records, the impact will usually be serious.
• If the compromised user has elevated privileges within the application, then the impact will generally be critical, allowing the attacker to take full control of the vulnerable application and compromise all users and their data.