SnoopServlet vuln to xss

0
35

Posted by Saleh on Jul 02

SnoopServlet simply echos back the request line and the headers that
were sent by the client, plus any HTTPS information.

Search Google for: j2ee/servlet/snoopservlet to find a lot of vuln sites.

PoC:
http://apad1.aduana.gob.bo:7777/j2ee/servlet/SnoopServlet/%3Cscript%3Ealert%28%27bo9lo7%27%29%3C/script%3E

Source: SnoopServlet vuln to xss