Niptech/niptech-live — pull request #1 by matleclaire (2013-08-25 16:20:37+00:00)
Title: Escape special html characters (to avoid XSS)

Hi,

You can easily inject JS code during a niptech live.

## Exploit

1. Go to http://live.niptech.com with Chrome.
2. Browse the source code and look for a line like
* `var chatSocket = new WS("ws://live.niptech.com/room/chat?userid=1377444563023")`
3. Look at the **userid** var and keep it ;)
4. Open a JS console and type :
* `var WS = window['MozWebSocket'] ? MozWebSocket : WebSocket;`
* `var chatSocket = new WS("ws://localhost:9000/room/chat?userid=1377435468097");` with your userid
* `var sendText = function(textMsg) {
chatSocket.send(JSON.stringify(
{text: textMsg}
))
};`

Now you can send messages to others with :

* `sendText("Hello from JS console");`

Or change your username :
* `sendText("nickname:toto");`

And you can also send JS code like :
* `sendText("")`
* `sendText("nickname:Bill")`

It will be injected in connected browsers.