> For the complete documentation index, see [llms.txt](https://ibraradi.gitbook.io/write-up/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ibraradi.gitbook.io/write-up/came-looking-for-ssrf-and-found-xss.md).

# Came looking for SSRF and found XSS

## Function :

Importing bookmarks from an external website

### How it works :

1. The function takes URL
2. Sends HTTP request to the URL
3. Previews the bookmarks into the website
4. Then storing it into the page

### Bookmarks

📌 The function only shows the content of the "a" and  "title" tags from that external URL

**I tried every possible SSRF attack I know ,but nothing worked.**

## XSS: 

### Self XSS :

I just created a website with The next content :

```html
<title> 
Tittle Injected<img src=x onerror=alert(1)>
</title>

<a href="#">
Link Injected<img src=x onerror=alert(1)>
</a>
```

And Sent the request to my website from the bookmarking function

The "a" tag content is being filtered but titile is not,

For now it’s just a self XSS.

![](/files/q7DxFsS10ndzk6wLRY7w)

![](/files/bZYanFpWQSh0fGVz1cJT)

### Stored XSS :

* The “Add” function here stores the bookmarks into the website.
* The self XSS accepted any payload,No kind of XSS prevention is being implemented their.
* **The add function removes the JS Events from the bookmarks before storing it into the website**

### After a good fuzzing the next payload worked:

```html
<audio src/onerror=alert(document.cookie)>
```

It’s stored in the next form :

```html
<audio src(unknown) onerror="alert(document.cookie)">
```

📌 The report was closed as informative because of the program’s policy

They don’t accept XSS for some reason.