BugBountyHunter

Hello Team,

Summary

Endpoint : /about.html Payload Used : javascript:alert(document.cookie)

I have found a Reflected XSS at /about.html endpoint. While sending the request to /about.html, there is a intermediate request and while reading the DOM, we can notice that it is taking a parameter name return_url. We can put any arbitary URL in the parameter and it will redirect us to that URL. I have exploited this to reflected XSS.

Steps To Reproduce:

1. GO to the http://cc0ee1c7497f-ayush1098.a.firstbloodhackers.com/about.html?redirect_url=javascript:alert(document.domain).

2. It will alert the domain of the container. We can exploit this to steal cookies of the doctor(still trying to find a way to register)

Impact:

Cookie Stealing, Session Hijacking etc..

Thanks & Regards

Ayush Singh