How I found reflected XSS on IDFC Bank with burp-suite Intruder
My name is Santosh Kumar Sha, I’m a Security Researcher/Ethical Hacker from India(Assam). In this article, I will be describing How I found reflected XSS on IDFC Bank with burp-suite Intruder
Don’t go outside test scope without any permission. Stay safe and also hack safe . Special request to my fellow bug-bounty hunter Take care of your health and always abide the rule of engagement.
TOOLS used for the exploitation
1. Subfinder (https://github.com/projectdiscovery/subfinder)
2. httpx (https://github.com/projectdiscovery/httpx)
3. gau(Corben) — https://github.com/lc/gau
4. waybackurls(tomnomnom) — https://github.com/tomnomnom/waybackurls.
5. Burpsuite — https://portswigger.net/burp
Story Behind the bug:
This is the write-up of my how i found multiple reflected XSS using burp-suite intruder and automated it to find multiple XSS is on different domains with fuzzing parameters at a same time.
I was working some automation and got invite for new for target. So, while casually browsing and exploring the main domain i got were i notice an endpoint where it was reflected my input in HTML tag but it was block all xss payload payload due to waf and also encoding all the special character to limit the xss.
Here it goes:
Suppose we assume the target name is idfcfirstbank.com where every thing is in-scope like this:
In-scope : *.idfcfirstbank.com
To gather all the subdomain from internet archives i have used subfinder , waybackurls tool and gau.
subfinder -d idfcfirstbank.com silent
gau -subs idfcfirstbank.com
So the chance of missing the subdomain still exist so in-order to be ahead of the game I don’t want to miss any subdomain for testing so I used subfinder and pipe to waybackurls to get all the domain for all the subdomain if exist and save it to a file.
So the final command will look like this:
gau -subs idfcfirstbank.com | unfurl domains>> vul1.txt
waybackurls idfcfirstbank.com| unfurl domains >> vul2.txt
subfinder -d idfcfirstbank.com -silent >> vul3.txt
Now collecting all subdomain in one and sorting out the duplicates
cat vul1.txt vul2.txt vul3.txt | sort -u >> unique_sub.txt
As, if now i have collect all the unique domain and stored them on “unique_sub.txt”
Now Creating customer word-list for fuzzing the parameter:
gau -subs dnb.nl | grep “=” | sed ‘s/.*.?//’ | sed ‘s/&/\n/’ | sed ‘s/=.*//’ >> param1.txt
waybackurls dnb.nl | grep “=” | sed ‘s/.*.?//’ | sed ‘s/&/\n/’ | sed ‘s/=.*//’ | sort -u >> param2.txt
cat param1.txt param2.txt | sort -u >> param.txt
As, if now i have collect all the unique parameters and stored them on “param.txt”
Now I have unique domain and customer parameter for fuzzing.
NOW the actual Automating reflected XSS with burp-suite Intruder start:
So while playing around the endpoint on burp repeater I have across an parameter was reflecting inside an HTML tag but when i was injected the XSS payload it was blocked by WAF and also with encoding the special character which was very hard to bypass.
I tried multiple encoding and decoding technique to bypass this and also tried multiple WAF bypass payloads and some custom payload but no success. It very was hard to bypass the waf and encoding to trigger the xss as it was on Their main domain.
So, After trying everything I thought why out try the same endpoint on other domain and also check if there will be some other parameter which may be vulnerable, that i might have missed.
Using This method I was able to multiple reflected XSS using burp-suite intruder. I reported all the issue in single report and as ALL issue were same because of same root cause, so was reward once only.
Moral For Story:
Use burp-suite as automation tools because its unlimited power to offer and also you don’t need an programming knowledge for it, just you need to know how to use it.
I’m sure that a lot of security researcher had already see there process but this how I approach for found multiple reflected XSS using burp-suite intruder.
That’s one of the reasons why I wanted to share my experience. also to highlight other techniques to exploit such vulnerability.