How I found Reflected XSS in NCSC UK

Hi, I hope you're well. In this article, I'm writing about how I found Reflected XSS in NCSC UK.

One of my friends messaged me in Facebook saying that he found Insecure Deserialization in NCSC UK. This got me curious and I also wanted to report a vulnerability to them but I wanted to do it quickly without digging too deep. So, I started with my usual recon flow.

Reconnaissance

At first, I enumerated subdomains using subfinder which returned about 682 subdomains.

$ cat domains.txt | subfinder -silent -recursive > subdomains.txt

Then, I probed for HTTP Servers on port 80 and 443 using httprobe

$ cat subdomains.txt | httprobe > probedSubdomains.txt

I was interested in testing an application with login/registration feature, so, I took screenshot of all the domains to choose a target visually.

$ gowitness file -f probedSubdomains.txt

After gowitness ended running, I looked at the screenshots and found an interesting target.

https://my.ncsc.gov.uk

Starting the hunt

I registered for an account and then I started browsing the application to get an idea of how it works and what features it might have. I found that the application was using GraphQL. However, I didn't want to enumerate all the queries and mutations and test them individually to find a vulnerability. I just wanted to find something quickly and withdraw from it because I was feeling quite tired after prior engagement.

So, I continued browsing the web application until I came across the "Change Password" feature. When I clicked on "Change Password" the browser redirected me to a link that looked like this https://URL/change_password?url=https://URL/home

After I changed my password, a button appeared, which when clicked redirected me to https://URL/home.

So, I decided to replace https://URL/home in https://URL/change_password?url=https://URL/home

to javascript:alert(1)

I changed my password again, clicked the button, which executed the payload.

As soon as I found it, I reported it and got +7 Reputation in Hackerone and acknowledgement from NCSC.

Comments

Mysterious Javascript Code Found Infecting Hundreds of Websites

After installing Wappalyzer in my browser, I decided to test its functionality by visiting a familiar website. To my surprise, I was unexpectedly redirected to a spear phishing campaign. Knowing the website's usual practices, it seemed highly unlikely that they would intentionally redirect their visitors in such a manner. Intrigued by this anomaly, I took it upon myself to investigate the underlying cause of this redirection. I have not yet known how threat actors implanted the Javascript Code in the victim's application but this is what it looked like. What does the code do? The code is simply importing script from biggerfun[.]org domain. In other words, it's simply doing <script src="biggerfun[.]org"></script> Further investigation I wanted to check if others think the website is bad, so I looked into it more. I observed they do things similar to another group called TA569. You can learn more about TA569 here: ...

Typographical Errors | Diving Deep into Typographical Errors and Mistakes

Typographical Errors Most of this blog was put together with the help of ChatGPT. This was put together to create a typographical error generator given any string. What is a Typographical Error? A typographical error, commonly known as a "typo," is a mistake made in the typing or printing process of written material. These errors can arise from inadvertent keystrokes, inattention, or misjudgment during the editing phase. While they might seem minor, typos can sometimes alter the meaning of a sentence or lead to misunderstandings. They occur in various forms, including the omission, addition, transposition, or substitution of characters. With the advent of digital writing tools, auto-correct functions have also become a frequent source of unintentional typos. Regardless of their origin, it's essential for writers, editors, and publishers to thoroughly review content to ensure clarity and accuracy. What are the types of Typographical Errors? 1. Substitut...

Prevent account takeover with proper cookie configuration

In this blog, I am writing about how improperly configured cookie may lead to account takeover. The type of account takeover I'm writing about is only possible when you're in the same local network as victim. Before explaining the issue, I want to thank Veshraj Ghimire for reviewing this. Misconfiguration #1: Not using 'secure' flag while setting cookies What is 'secure' flag? The secure flag is a setting that can be specified when a cookie is created and sent from a web server to a client browser. When a cookie is marked with the secure flag, the client browser will only transmit the cookie back to the server over a secure HTTPS connection. If the secure flag is not set, the cookie will be sent over both secure and insecure connections, making it vulnerable to eavesdropping and tampering by malicious actors. Misconfiguration #2: Cookie scoped to all the subdomains What do I mean by "cookie scoped to all the subdomains"? If yo...

Information Security Blog

Search This Blog