How I found Reflected XSS in NCSC UK

Hi, I hope you're well. In this article, I'm writing about how I found Reflected XSS in NCSC UK.

One of my friends messaged me in Facebook saying that he found Insecure Deserialization in NCSC UK. This got me curious and I also wanted to report a vulnerability to them but I wanted to do it quickly without digging too deep. So, I started with my usual recon flow.

Reconnaissance

At first, I enumerated subdomains using subfinder which returned about 682 subdomains.

$ cat domains.txt | subfinder -silent -recursive > subdomains.txt

Then, I probed for HTTP Servers on port 80 and 443 using httprobe

$ cat subdomains.txt | httprobe > probedSubdomains.txt

I was interested in testing an application with login/registration feature, so, I took screenshot of all the domains to choose a target visually.

$ gowitness file -f probedSubdomains.txt

After gowitness ended running, I looked at the screenshots and found an interesting target.

https://my.ncsc.gov.uk

Starting the hunt

I registered for an account and then I started browsing the application to get an idea of how it works and what features it might have. I found that the application was using GraphQL. However, I didn't want to enumerate all the queries and mutations and test them individually to find a vulnerability. I just wanted to find something quickly and withdraw from it because I was feeling quite tired after prior engagement.

So, I continued browsing the web application until I came across the "Change Password" feature. When I clicked on "Change Password" the browser redirected me to a link that looked like this https://URL/change_password?url=https://URL/home

After I changed my password, a button appeared, which when clicked redirected me to https://URL/home.

So, I decided to replace https://URL/home in https://URL/change_password?url=https://URL/home

to javascript:alert(1)

I changed my password again, clicked the button, which executed the payload.

As soon as I found it, I reported it and got +7 Reputation in Hackerone and acknowledgement from NCSC.

Comments

Mysterious Javascript Code Found Infecting Hundreds of Websites

After installing Wappalyzer in my browser, I decided to test its functionality by visiting a familiar website. To my surprise, I was unexpectedly redirected to a spear phishing campaign. Knowing the website's usual practices, it seemed highly unlikely that they would intentionally redirect their visitors in such a manner. Intrigued by this anomaly, I took it upon myself to investigate the underlying cause of this redirection. I have not yet known how threat actors implanted the Javascript Code in the victim's application but this is what it looked like. What does the code do? The code is simply importing script from biggerfun[.]org domain. In other words, it's simply doing <script src="biggerfun[.]org"></script> Further investigation I wanted to check if others think the website is bad, so I looked into it more. I observed they do things similar to another group called TA569. You can learn more about TA569 here: ...

Getting unlimited money by abusing the 'Send Money' feature

It has been a while since I published a post. So, I am writing this one to share one of my interesting finding while testing an e-wallet application. I glanced at my Total Balance and I was wondering if there was a way for me to increase it arbitrarily. So, I thought Race Condition would help me here. What is a Race Condition vulnerability? "A race condition vulnerability typically occurs when your application has access to the same shared data and attempts to change variables within it simultaneously ." - automox.com So, I loaded up Turbo Intruder in Burp Suite and attempted testing it. I failed. I couldn't exploit it. I didn't want to give up this soon. I kept that fire bottled up and changed my approach. I realized that the 'Send Money' feature uses basic maths to reduce balance from the sender's account and add it to the receiver's account. So, the feature did the following operations: function sendMoney(sender, receiver, amoun...

Finding ways to misuse application features | An example

I am publishing this without reviewing or re-reading. I apologize if you see any mistake here. Have a great day! Introduction Hi, I hope you are well. I am writing this blog after a long time so some of my writing skills might have faded away. Talking about skills, I've mastered one, and it is my ability to spend unlimited amount of time trying to understand every single feature of a target application. Sometimes I find a way to leverage those features into vulnerabilities other times I end up learning a lot of things from them. So, I'm using this article as a means to share one of the findings that ended up being duplicate. Bypassing email verification step when registering new email addresses I was looking at a bug bounty program and I found an application that allowed anyone to register and login to it. So, I created an account to poke around with the features. The first feature I looked at was the registration feature itself. When I created an ac...

Information Security Blog

Search This Blog