XSS via POST

Hi everyone!<br /><br />Throughout the forum I've seen many papers or tutorials about XSS, but none talks about the POST method.<br />A few days ago an XSS via POST was reported in Underc0de's contact form. Luckily it wasn't anything risky, but it was a vulnerability we had to fix.<br />This time we'll use the code of that contact form to reproduce the flaw and to see how to test whether our applications are vulnerable to XSS via POST.<br /><br />The contact form code is here: Los enlaces son solo para miembros. Registrate o iniciá sesión in case anyone wants to run the test.<br /><br />In addition, we'll need some tool that modifies the parameters we send via POST. I'll use Tamper Data which is a Firefox add-on: <br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Once the contact form is set up it will look something like this:<br /><br /><br /><br />The first step will be to fill in all its fields and open Tamper Data. Once this is done, we click "Start Tamper" (in Tamper Data) and submit the contact form.<br />After this, an alert will appear in Tamper Data to modify the data we are sending. <br /><br /><br /><br />We click modify, and we review the values it is sending on the right side, which are the ones we have loaded from the form.<br /><br /><br /><br />Now it's time to play with these fields. This contact form doesn't filter its variables, so we'll place some XSS vector in its parameters.<br />In this case, I placed a simple alert in the email field. <br /><br /><script>alert('XSS')</script><br /><br />On clicking OK, the site will keep loading with the new supplied information...<br /><br /><br /><br />And as you can see, the Alert appeared with our message.<br /><br />I hope it's useful to you!<br /><br />Regards!<br />ANTRAX