So I tried the phishing section for the XSS module without walking through most of the examples. Spent several hours trying to figure out why in the heck my payload worked locally(I could see username and password upon logging in), but NOT with ‘/send.php’.
For whatever reason, I did NOT put ‘name=“submit”’ for “input type=“submit”” in the payload. It makes sense why this works locally; the index.php script being used is looking for ‘username’ and ‘password’ fields via the isset() function. I’m pretty sure ‘/send.php’ is looking for “submit” as a conditional. I might be wrong about this, but it makes sense.
tldr: just copy the html form presented via the top of the page. Make sure each field, including the button, is named.
Based on the XSS payload we know that we need to start our XSS injection payload with '>
Then let’s submit ‘>test and the source looks like. ’>
to make this clearer let’s group this like below: '>
So essentially by adding the '> as input we complete the img src tag.
So, I would think then in the final payload when doing the assignment one also would use the '>
But in all of these discussions all the sudden one needs to use '/>
It is foundamental that you write the HTML part as in the example. The placeholders have to be “Username” and “Password” otherwise the send.php page will not work. The names of the elements have to match as well… This was the problem on my side. Hope this helps.
I’ve been hours with this question. I got on my nerves and my only problem was that I was using my VM with a VPN and not the Pwnbox. The only thing I changed was the IP and the port.
If anyone on the htb team is reading this please fix this issue.
Yeah for anyone still attempting this, after about 4 hours of banging my head against the desk I finallly figured out that you HAVE to set the IP as your tun0 IP otherwise it WILL NOT WORK. You don’t have to do any extra encoding. Copying and pasting the url already encodes it. I attempted it a hundred different ways to no avail but the very first time I changed the IP to my tun0 it was instant success. Good luck
I faced this same issue as I was doing the module. What worked for me is using the Pwnbox that is provided by HTB.
There was no need to encode the url or parts of it. It just worked. Hope you find this helpful
```` edit the OUR_IP with your pwnbox tune0 ip , with port of your choice …paste the payload into your phishing/index.php , once the payload is successfully activated … mkdir /tmp/tmpserver… touch index.php , sudo nano index.php …paste this php…`
edit Server_IP with your pwnbox tune0 ip ... then sudo php -S 0.0.0.0: port you choose in your payload .....open new tab...http://target_Ip/phishing/send.php.... copy your index.php payload tab and paste it in send.php url input ..... figure the rest out
There are the following conditions to be met to solve this challenge:
Do not use your own machine with VPN. Use the Pwnbox.
Do not modify the /etc/hosts to add a custom domain (e.g., {ip_address} {domain}. Use the given IP address.
You need to encode the malicious URL before using it in /phishing/send.php. You must NOT encode http://{pwnbox_ip}:{port} (Since 80 is being used, you need a different one, e.g., 8080).
In case you can’t still solve the challenge, refer to the encoded URL below
