# Destroying Armies and Villages through Cross-Site Scripting - Bug Bounty Write-up

Stored XSS in Tribal Wars tribe forum Subject field let attackers exfiltrate victim email/IP and enable account-sitting to hijack the game account.

- Payout: $1,214 (paid EUR 1000)
- Severity: high
- Program: InnoGames
- Credited: Fábio Freitas
- Disclosed: 2021-01-29
- Write-up quality: 7/10
- Original: https://0xfabiof.github.io/stored-xss-tw/
- Library page: https://bugbountylibrary.com/r/blog%3A0xfabiof-github-io-stored-xss-tw
- Tags: domain:web impact:ato impact:pii-leak kind:bounty platform:blog sev:high tech:rest technique:source-review vuln:account-takeover vuln:xss

**Target:** Tribe forum new-topic Subject parameter (game.php web app)
**Root cause:** The forum topic Subject parameter was sanitized only client-side, so intercepting the request allowed raw HTML/JS injection stored and rendered to all viewers.
**Steps:**
1. Create a Tribe and open its Forum, start a new topic.
2. Intercept the create-topic request and set Subject to `<script>alert()</script>`; observe execution on forum view.
3. Host payload JS on attacker HTTPS server and inject `<script src=...>` in Subject to bypass length limit.
4. Payload XHRs `game.php?village=14&screen=settings&ajax=full_email_address` and `screen=settings&mode=logins` with credentials, regex-extracts IP, exfiltrates to attacker server.
5. Second payload POSTs `save_vacation_permissions` with all permissions `on` and `sitter_offer` with `sitter=Jose123`, using CSRF `h` token scraped from DOM.
**How found:** After testing many endpoints for access control and injection, created a Tribe to explore functionality; noticed all other params were sanitized client and server-side but the forum Subject only client-side, so intercepted the request and injected a payload.
**Exploitation:** Victim opening the tribe forum executes attacker JS in their session; HTTPOnly cookie blocks session theft and password/email change require current password, so attacker instead enables all account-sitter permissions and requests sitting to attacker account, gaining 48h control to destroy villages/resources.
**Escalation:** Pivoted from PII leak to full game-account takeover via the account-sitting feature, raising severity from Medium to High.
**Insight:** When a field is sanitized only in the browser, intercept and resend raw; then look for in-app delegation features (account-sitting, sharing, sub-users) as an ATO path when HTTPOnly cookies and password-gated changes block classic takeover.