xss in Microsoft mobile domain

Cookies xss in Microsoft mobile domain also it have xframe open vulnerability for click jacking

Domain: m.microsoft.com

Poc url steps for reproduce issue are same in both url so I am send both url and steps by using one of them

Poc urls :

1. http://m.microsoft.com/showcase/en/US/Search.mspx?a=results&mid=3900&phrase=%5burl%3djavascript:alert(document.cookie)%5dClick%20here%20to%20see%20Result%5b/url%5d&Search=

2. http://m.microsoft.com/showcase/en/US/search?pageindex=sv1:2&phrase=[url%3djavascript:alert%28document.cookie%29]click%20here%20and%20see%20your%20result[/url]

Vulnerable parameter: phrase=

Steps for reproduce issue

Poc url

http://m.microsoft.com/showcase/en/US/search?pageindex=sv1:2&phrase=[url%3djavascript:alert%28document.cookie%29]click%20here%20and%20see%20your%20result[/url]

when users use url .That give a result in Microsoft site like

Result is show click here to see result

When user click on that xss payload run its depend on you which type you want like alert , prompt or more harmful for users like steal cookies of users of Microsoft account

More like cookie xss

When I am more research on that I found that its also have click jacking vulnerability then I am use that also with xss now

I am set new poc and make a site with some button when user come to my site and click on any button I can steal users cookie of Microsoft account with sessions

See how … that’s my site when come

User click on click here button

See what’s behind the click button

In behind a Microsoft site page in a frame by this an attacker can easily capture cookies of users

Thanks……. Happy hunting

Poc By -- Jitendra Jaiswal

Facebook/desihack

twitter/jeetjaiswal22

Comments

Click-jacking or UI Redressing

Hi! Just want to share my finding, I have found Click-jacking or UI Redressing Vulnerability in on Google Map , enjoy ;-) This bug was reported to Google Security Team, fixed immediately. About Title: ClickJacking or UI Redressing on Google Map Business Risk: Normal Discovery Date: October 8, 2013 Author: Jitendra Jaiswal (me) Poc Details Impact On victim : 1. attacker change victim profile pic by useing his webcam and upload 2. update status acording to attacker Best, Jeet Jaiswal

Facebook Web Security Bug Bounty: Directory Traversal Vulnerability / RCE In Parse.com

http://parse.com directory traversal vulnerability Little Insight: http://parse.com was vulnerable to a directory traversal / RCE vulnerability. As a result, it was possible for an attacker to load web server-readable files from the local filesystem. or Run commend on That Well this is my 4th reward form facebook Directory Traversal or RCE Vulnerability That give me 5th position in Facebook white-hat Page Report Date :23 July 2014 Reward For Directory Traversal or RCE Vulnerability : 20000$ How This work......? As we discussed earlier on my old post Flowdock Directory Traversal Vulnerability exposed files outside of Rails’ view paths. '%5C' turns into '\' after decoding. Using Rack::Protection it only rejects '/../' segments in the request path. patch apply for Rack::Protection acording CVE-2014-0130 and also Reject now '%5C' turns into '\' af...

HC WeB : A Browser for HACKERS...

A Browser for HACKERS... Try for Free... Download HC WeB Setup Gallery: Online Penetration Testing Tools Index Information Gathering Whois DNS Location Info Enumeration and Fingerprint Data Mining Search Engines Editors Online Text Editors Share Text Snippets Network Utilities Ping HTTP HTTPS VNC Remote Desktop SSH DNS Sniffers Misc Forensics Frameworks URL Cloaking E-mail Password Cracking Encoders and Decoders Encoders Decoders Malwares Malware Analysis Identify Malicious Websites Suspected Malicious IPs and URLs Application Auditing SQL Injection Cross Site Scripting File Inclusion Anonymity Proxy Others Hackery Open Penetration Testing Bookmarks Collection Hacker Media Blogs, Forums, Magazines and Videos. Methodologies Penetration testing frameworks, standards and methodologies. OSINT Presentations, People, Organizations and Infrastructure. Exploits an...

Hacking Concepts

Search This Blog