{"id":50,"date":"2021-04-25T00:46:00","date_gmt":"2021-04-24T17:46:00","guid":{"rendered":"https:\/\/n45ht.or.id\/blog\/?p=50"},"modified":"2024-12-14T12:15:55","modified_gmt":"2024-12-14T05:15:55","slug":"reflected-xss-on-microsoft","status":"publish","type":"post","link":"https:\/\/n45ht.or.id\/blog\/reflected-xss-on-microsoft\/","title":{"rendered":"Reflected XSS on Microsoft"},"content":{"rendered":"\n<p>During my recent bug bounty hunting, I started by gathering information on the Microsoft domain using a simple Google Dork query to locate potentially vulnerable pages. The search query I used was:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"HTML\" class=\"language-HTML\">site:*.*.microsoft.com ext:php<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"716\" height=\"359\" src=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-1.png\" alt=\"\" class=\"wp-image-52\" style=\"width:506px;height:auto\" srcset=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-1.png 716w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-1-300x150.png 300w\" sizes=\"auto, (max-width: 716px) 100vw, 716px\" \/><\/figure>\n\n\n\n<p>This helped me identify pages on Microsoft&#8217;s domain that had the <code>.php<\/code> extension. After reviewing the results, I came across a specific URL that seemed interesting:<\/p>\n\n\n\n<p>URL:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"HTML\" class=\"language-HTML\">https:\/\/msftguestus.partners.extranet.microsoft.com\/guest\/msft_a_guest_register.php?_browser=1<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"460\" src=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-2-1024x460.png\" alt=\"\" class=\"wp-image-53\" style=\"width:488px;height:auto\" srcset=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-2-1024x460.png 1024w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-2-300x135.png 300w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-2-768x345.png 768w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-2.png 1356w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>At this point, I decided to dig deeper into the parameters on the page. To accomplish this, I used a tool called <strong>Arjun<\/strong>. Arjun is an effective tool for discovering hidden parameters in web applications, and it helped me identify all the parameters that were being passed in the URL.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"395\" height=\"149\" src=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-3.png\" alt=\"\" class=\"wp-image-54\" srcset=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-3.png 395w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-3-300x113.png 300w\" sizes=\"auto, (max-width: 395px) 100vw, 395px\" \/><\/figure>\n\n\n\n<p>Once I had the parameters, I tested each one by injecting various <strong>XSS payloads<\/strong> to check for any Cross-Site Scripting (XSS) vulnerabilities. I started with a simple but effective payload:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" data-code=\"&quot;&gt;&lt;svg\/onload=alert(1)&gt;\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M4.5 12.75l6 6 9-13.5\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M16.5 8.25V6a2.25 2.25 0 00-2.25-2.25H6A2.25 2.25 0 003.75 6v8.25A2.25 2.25 0 006 16.5h2.25m8.25-8.25H18a2.25 2.25 0 012.25 2.25V18A2.25 2.25 0 0118 20.25h-7.5A2.25 2.25 0 018.25 18v-1.5m8.25-8.25h-6a2.25 2.25 0 00-2.25 2.25v6\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #D8DEE9FF\">&quot;&gt;<\/span><span style=\"color: #81A1C1\">&lt;<\/span><span style=\"color: #D8DEE9\">svg\/onload=alert(1)<\/span><span style=\"color: #81A1C1\">&gt;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>This payload triggers an alert box when the page is loaded, and after testing it on one of the parameters, the XSS vulnerability successfully triggered, confirming the presence of an XSS flaw.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"509\" src=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-4-1024x509.png\" alt=\"\" class=\"wp-image-55\" style=\"width:518px;height:auto\" srcset=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-4-1024x509.png 1024w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-4-300x149.png 300w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-4-768x382.png 768w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/writeup-microsoft1-4.png 1227w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>This vulnerability could potentially allow attackers to execute malicious scripts in the context of another user\u2019s session, which could lead to a variety of security risks such as session hijacking or information theft. I\u2019ve reported this issue responsibly, and I hope it gets patched soon.<\/p>\n\n\n\n<p>#HappyHacking<\/p>\n","protected":false},"excerpt":{"rendered":"<p>During my recent bug bounty hunting, I started by gathering information on the Microsoft domain using a simple Google Dork query to locate potentially vulnerable pages. The search query I used was: This helped me identify pages on Microsoft&#8217;s domain that had the .php extension. After reviewing the results, I came across a specific URL [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":51,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[23,9,8],"class_list":["post-50","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-research","tag-bug-bounty","tag-cross-site-scripting","tag-xss"],"_links":{"self":[{"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/posts\/50","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/comments?post=50"}],"version-history":[{"count":3,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/posts\/50\/revisions"}],"predecessor-version":[{"id":111,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/posts\/50\/revisions\/111"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/media\/51"}],"wp:attachment":[{"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/media?parent=50"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/categories?post=50"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/tags?post=50"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}