# [HTAF4-213] [Pre-submission] XSS via arbitrary cookie name at the https://www2.██████/nssi/core/dot_stu_reg/Registration.aspx

Cookie name reflected unsanitized on a DoD registration page; attacker sets a script-tag cookie via a sibling .mil XSS and redirects to trigger reflected XSS.

- Payout: hidden
- Severity: medium
- Program: U.S. Dept Of Defense
- Found by: sp1d3rs
- Disclosed: 2024-06-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/728001
- Library page: https://bugbountylibrary.com/r/h1%3A728001
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:medium tech:dotnet technique:chained vuln:xss

**Target:** ASP.NET registration page (Registration.aspx) reflecting cookie names
**Root cause:** The application reflects the attacker-controlled cookie name into the HTML response without sanitization, so a cookie named with an HTML/script payload executes in the page context.
**Steps:**
1. Identify that https://www2.<target>/nssi/core/dot_stu_reg/Registration.aspx reflects the first cookie name unsanitized.
2. From a sibling .<domain>.mil property with an XSS (pop_up_frm.asp?loc=javascript:...), run `document.cookie='zzz<script>alert(document.domain)</script>=zzz;path=/;domain=.<domain>.mil'`.
3. Redirect victim to `https://www2.<target>/nssi/core/dot_stu_reg/Registration.aspx`.
4. Cookie name is reflected and the script executes, alerting document.domain.
**How found:** Noticed the page reflects cookie names; realized a cookie name could carry an HTML payload and that a sibling-domain XSS could plant a parent-domain cookie to reach the target.
**Exploitation:** Attacker first exploits XSS on another .mil subdomain to set a cookie with a script-tag name scoped to the parent domain, then redirects the victim to the vulnerable Registration.aspx where the cookie name is reflected and executed, yielding script execution in the authenticated nssi context.
**Insight:** Cookie names (not just values) can be reflected into HTML; when a target shares a parent domain with any XSS-able sibling, use that sibling to set a maliciously-named cookie scoped to the parent domain and redirect to the reflecting endpoint.