1

I call it 'Meta-jacking'.

So this website I found has a meta with content="" and whatever you type in the description displays your text in the content. So I took advantage of this and typed:

0;//wwww.google.com"http-equiv="refresh"

and sure enough it redirected to google, is this some sort of XSS?

5
  • 1
    Can you be a bit more specific... "has a meta" - what kind of meta? "type in the description" - do mean in a form/input control? It might be a vulnerability - depends what you can do with it. What you have described isn't necessarily XSS either.
    – MrWhite
    Aug 29, 2015 at 16:09
  • Ok it's not my website, but in the website is does this weird thing where it puts whatever you write in your description in to a format like this: <meta name="description" content="Test" /> let's say I put my description to 'Test', then it would look like that. I took advantage of this by typing: 0;//www.google.com"http-equiv="refresh" so now the page would redirect to google because it looked like: <meta name ="description" content='0;//www.google.com'http-equiv="refresh">
    – Shade
    Aug 29, 2015 at 16:16
  • "write in your description" - is this some kind of profile page? Or a page generation tool of some kind? Or literally just a free-form type the description and hey-presto?
    – MrWhite
    Aug 29, 2015 at 16:59
  • It's a profile type of thing
    – Shade
    Aug 29, 2015 at 17:37
  • That would seem to be a XSS-type vulnerability, since presumably anyone can potentially view your malicious "profile" page and be unwittingly redirected. At the very least it could simply break the profile page - which innocent users might do by accident!? (NReilingh pretty much nails it.)
    – MrWhite
    Aug 29, 2015 at 18:23

1 Answer 1

2

Yes, that's pretty much a textbook example of XSS. When a site takes input and then serves it back to you in an executable manner, the site is vulnerable because a ne'er-do-well can direct a victim to the legitimate website in such a way that malicious code is "injected" into the session. The user thinks they are safe because the site is legitimate, HTTPS encrypted, etc. -- but since they were sent there by a malicious source leveraging the XSS vulnerability, the session is compromised.

This is exactly why we tell people not to click links in email.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.