XSS na tcma.rs
#1
Navodno eksploatisan je Cross Site Scripting (XSS) propust na tcma.rs. Na osnovu primera rekao bih da je samo reflektujući, ali i dalje postoje načini za zloupotrebu. Izvor: https://twitter.com/Lotusociety/status/1...0253691907, arhivirano: https://archive.ph/cMST7.

[Image: attachment.php?aid=410]

Link iz POC je: hXXps :// hastebin[.]com/raw/iqoredoyux, arhivirano: https://archive.ph/dX1Ir.


Attached Files Image(s)
   
“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Reply
#2
Poruka koju ostavljaju je nešto ovako (kada se dekodira JS):

Code:
<html>
<head></head>
<body>
  <iframe width=\"0px\" height=\"0px\" src=\"https://i.top4top.io/m_1650emaee1.mp3\" allow=\"autoplay; encrypted-media\" allowfullscreen></iframe>
  <title>Lotusociety Team</title>
  <meta http-equiv=\"Content-Language\" content=\"ar-lb\">
  <meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\">
  <meta content=\"Hacked by fedi\" name=\"description\">
  <meta content=\"Hacked by fedi\" name=\"keywords\">
  <meta content=\"Hacked by fedi\" name=\"Abstract\">
  <style type=\"text/css\">
body {background:black; color:#FFFFFF; text-decoration:none; font-family:Concert One; font-size:16px;}
img:hover {opacity:1;}
a {text-decoration:none; color:#FFFFFF;}
a:hover {text-decoration:none; color:#666666;}
</style>
  <link href=\"https://fonts.googleapis.com/css?family=Iceland\" rel=\"stylesheet\" type=\"text/css\">
  <center>
   <br>
   <br>
   <br>
   <font face=\"Iceland\" size=\"6\" color=\"red\"> </font>
   <img src=\"https://pbs.twimg.com/profile_images/1611923726429483010/lUCj-t3W.jpg\" width=\"300\" height=\"300\">
  </center>
  <center>
   <br>
   <font face=\"Iceland\" size=\"8\" color=\"red\"> Hacked By Lotusociety Team</font>
   <center>
    <font face=\"Iceland\" size=\"5\" color=\"white\"> <p>Stop being fooled by the illusion of wealth. Big houses, expensive cars, designer items, and a fancy lifestyle are not wealth; they are debt. Wealth is time, freedom, options, and health.</p> <p>Your Website Has Been Hacked </p> <p align=\"center\"><b><font face=\"Courier New\" size=\"7\"> </font> </b></p><p align=\"center\" style=\"color:red;margin-left:20px;\"></p><b> </b></font>
    <b>
     <center>
      <h5 class=\"Style8\" style=\"font-size: medium\"> <strong>Bye! </s    trong> </h5>
      <h3 class=\"Style8\"> </h3>
      <address> Contact:<br> <a href=\"Twitter : @Lotusociety - @Anonymous_VNPC\">@Anonymous_VNPC</a> </address>
      <center>
       <p></p>
       <center>
        <noscript>
         <a href=\"http://en.dnstools.ch/show-my-ip.html\" target=\"_blank\">IP address signature</a>
        </noscript>
       </center>
       <p></p>
       <p></p>
       <p></p>
      </center>
     </center></b>
   </center>
  </center>
</body>
</html>

[Image: attachment.php?aid=412]



Preporuka za građane, ne otvarajte linkove koji Vam stižu od nepoznatih izvora, a vode na https://tcma.rs. Jedna od Anonimus grupa je pronašla propust koji može da izmeni stranicu sa ciljem umetanja malicioznog koda.


Attached Files Image(s)
   
“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Reply
#3
Pretraga na ovom sajtu trenutno ne radi, a XSS je u ovoj funkcionalnosti, tako da pretpostavljam da su nadležni privremeno isključili pretragu kao način prevencije eksploatacije.
“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)