https://github.com/tikene/fun-dare-vulnerability-write-up
A write-up describing the discovery and exploitation of a vulnerability I found on fun-dare
https://github.com/tikene/fun-dare-vulnerability-write-up
Last synced: 10 months ago
JSON representation
A write-up describing the discovery and exploitation of a vulnerability I found on fun-dare
- Host: GitHub
- URL: https://github.com/tikene/fun-dare-vulnerability-write-up
- Owner: tikene
- Created: 2021-11-24T11:02:46.000Z (over 4 years ago)
- Default Branch: main
- Last Pushed: 2022-02-05T16:25:15.000Z (over 4 years ago)
- Last Synced: 2025-03-30T21:17:28.800Z (over 1 year ago)
- Language: Python
- Size: 13.7 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
## How an XSS vulnerability could have affected +1 million users
- [Index](#how-an-xss-vulnerability-could-have-affected-1-million-users)
* [1. Introduction](#1-introduction)
* [2. Finding the vulnerability](#2-finding-the-vulnerability)
* [3. Looking for targets](#3-looking-for-targets)
* [4. Potential risks](#4-potential-risks)
* [5. Conclusion](#5-conclusion)
### 1. Introduction
Cross Site Scripting (XSS) exploits are often overlooked by developers even though they can present a serious threat to a web application. It is caused by improper sanitization of user input, which allows an attacker to run malicious client-side javascript code. A JS payload can steal cookies from unsuspecting users and send them to a C&C server, edit the website's content, or perform actions such as changing the password or email silently.
It all started when a friend sent me a link of this new quizzes site called q.fun-dare, which was quickly becoming viral among Instagram users. He asked if I could make a bot for it like I have previously done with f3.cool, a similar website.
(For later reference, the generated ID is 25074480)
### 2. Finding the vulnerability
I initiated Nikto and Dirbuster scans, and then started messing around using Burp. After a few minutes I came across the submit quiz answers endpoint, which looks like the following:
Four parameters are being sent to the server, qid (Quiz ID), score (Nº of correct answers), answerData (Selected responses) and pname (Player name).
My first thought was to change the score to a negative number or an absurd amount such as 999999, and answerData to an empty array, and funnily enough the server accepted it as a valid request.
After these red flags I figured finding a vulnerability inside the code could actually be a realistic option, so I sent a request with the following code as the "pname" parameter: "alert(document.cookie);"
This was the result:
The code is automatically executed once the user enters the URL, great!
Finding a stored XSS vulnerability within 5 minutes of pentesting shows the lack of awareness some developers have towards the potential risks of Cross Site Scriping vulnerabilities (To be fair, I believe some type of sanitizing is being done since this doesn't work if you manually type the js in the name field without using Burp). Since any quiz can be answered, I can also infect other people's questionnaires. I recognize I had some fun "hacking" my friends.
https://user-images.githubusercontent.com/92279236/143238026-71d6e648-c7f8-462c-9616-439bc3e9224f.mp4
### 3. Looking for targets
Now it was a matter of trying to find other quizzes to hack. I started looking by hand, adding 1 to my generated ID (25074480 + 1) or substracting but that didn't work, which led me to believe urls are generated randomly (as it should be). Since the website is pretty famous and IDs are only 8 numbers long, I figured I could bruteforce my way through it, so I created a simple python script.
Did you notice a weird pattern? I definetly did not for more than an hour (to be fair it was 3 am)
That's right, URLs are not random like I previously thought, they're just generated by adding 18 to the last registered challenge ID. This just makes the XSS vulnerability much worse, since an attacker could easily exploit every challenge in the website. The amount of quizzes created since I started this pentesting can be calculated by doing
(New ID generated - Old ID generated) / 18
So, if we subtract the newly generated ID (34302810 - 11/25/2021), and the first one I encountered (25074480 - 11/18/2021) and then divide it by 18 (ID step).
That leaves us with 512.685 registered quizzes just the past week, or 1.742.818 in total (would be 1.906.072 but I found out IDs start from 163254).
We can also assume more people play challenges rather than create them
### 4. Potential risks
A malicious attacker could easily create a ddos botnet, prompt users to download malicious software, or create google/facebook fake login popups. I made a PoC script which automatically injects the following tag used to load javascript code from an external URL
```
```
https://user-images.githubusercontent.com/92279236/143266952-e79e99d2-8d3c-4533-9d3c-52b80619d3c0.mp4
Javascript may have restricted access, but it can steal user cookies, perform dos attacks, mine bitcoin, create phishing popups... These attacks can also be very stealthy if performed correctly. If a website has security measures, such as showing a log of IPs that have connected to an account, it can be modified so it doesn't display the attacker's ip. When my javascript code appears in the quizz's scoreboard (sice it's injected as my player name), I can hide it too. An invisible iframe can also be created to perform actions on behalf of the target. Basically, XSS might not give control over the website but it gives total control over its users, and phishing attacks could even target webadmins in order to harvest credentials and take over the domain.
**Some useful resources:**
- [Steal cookies script](https://github.com/s0wr0b1ndef/WebHacking101/blob/master/xss-reflected-steal-cookie.md)
- [Javascript bitcoin miner](https://github.com/jwhitehorn/jsMiner)
- [BeEF framework](https://null-byte.wonderhowto.com/how-to/hack-web-browsers-with-beef-control-webcams-phish-for-credentials-more-0159961/)
https://user-images.githubusercontent.com/92279236/143231612-a99e550f-296a-48aa-bbea-25c5ee21e5c3.mp4
### 5. Conclusion
Only a couple random quizzes were injected to test the vulnerability (A harlem shake script), but the potential attack vector is huge. I also noticed there seems to be no time delay when creating or submitting to quizzes, and captchas have not been implemented. This could lead to a DoS attack because of the relatively high amount of processing power required to generate them.
I contacted the website developer and am currently waiting for him to fix it, I'll update when he does.
#### Thanks for reading and remember to sanitize user input & always keep in mind the OWASP Top 10 security risks!
