3

I have a Qualys web application scan report that says I have a XSS vulnerability. It explains this was detected by requesting a malicious payload and evaluating the response.

When I make the same request, I'm getting a different response that doesn't appear vulnerable.

The request: https://my.site/asection/Some%20Param?"><qss>=

Response the scanner gets: 

<a href="/asection/index.cfm?param=A Different Param&"><qss>=" class="current">

Response I get:

 <a href="/asection/index.cfm?param=Some Param&%22%3E%3Cqss%3E=" class="current">

Why can't I duplicate the scanner's results? What do I need to do to get a clean scan?

EDIT: Thanks for the advice, all. I'm afraid I'm still stumped here. I've tried making the request from a browser, from python via requests and from wget with the same results (shown above). The headers I'm seeing from Qualys: enter image description here

GET https://my.site/asection/Some%20%20Param?"><qss>=
Referer: http://my.site/
Cookie: JSESSIONID=48BBDB43C2DAF217644045004E3AF105.cfusion; CFTOKEN=4e91b60205baf756-E6723476-DAFC-BF6E-EB44114CE65CBF13; CFID=7001629;
Host: my.site
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/601.4.4 (KHTML, like Gecko) Version/9.0.3 Safari/601.4.4
Accept: */*

and the headers I'm seeing with wget (via wget -d "https://my.site/asection/Some%20Param?\"><qss>="

GET /asection/Some%20Param?%3E%3Cqss%3E=%0A HTTP/1.1                                                            
Referer: http://my.site/
Cookie: JSESSIONID=48BBDB43C2DAF217644045004E3AF105.cfusion; CFTOKEN=4e91b60205baf756-E6723476-DAFC-BF6E-EB44114CE65CBF13; CFID=7001629;   
Host: my.site
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/601.4.4 (KHTML, like Gecko) Version/9.0.3 Safari/601.4.4                                                                                                                
Accept: */*                                                                                                             
Accept-Encoding: identity                                                                                               
Connection: Keep-Alive

I've re-run the scan and it still detects the vulnerability. I've reviewed Why isn't this XSS working?. Are all of my requests getting returned URL Encoded? Is there a tool (or a flag in wget/requests) that will let me suppress this to see the raw response or the decoded response?

Improve this question
4
  • Do you use the same headers as Qualys scanner do? Make sure You are reproducing full HTTP request, not just the URL one
    – RedS
    Commented Sep 18, 2019 at 20:57
  • 2
    Possible duplicate of Why isn't this XSS working? It's not an exact duplicate, but I'm quite sure the answer applies to your case too.
    – Arminius
    Commented Sep 18, 2019 at 21:02
  • How are you sending such request? Maybe with a browser that contains an anti-XSS?
    – Ángel
    Commented Sep 18, 2019 at 21:05
  • Try the URL via cURL or wget in a terminal of whatever OS you are using - the response looks the same except that your browser is encoding your request
    – LTPCGO
    Commented Sep 18, 2019 at 23:16

1 Answer 1

Reset to default
1

Your header is of course showing it in URI encoding because it's a URI. You need to look at the actual body - your report stated it was in an a tag, so look for that a tag. Pass your output through grep and it should fall out. You won't see it in a GET because that is the data you are sending to the server (or directly what the server is receiving, either way)

Improve this answer
4
  • Could you clarify how to "look at the actual body." I was under the impression that the methods I was using (browser, wget, python requests) were displaying the response body (a snippet of which I included in the "Response I get" section of the post.) I only put the headers into my post to demonstrate if the headers on my requests were comparable to the headers in the scanner's request.
    – roms
    Commented Sep 24, 2019 at 14:48
  • Hmmmm, I did mean the response body, from curl/wget etc. Not sure now, complete guess but maybe something with the -d flag makes is altering it - you do show the request headers directly from the terminal, right? How does qualys display theirs?
    – LTPCGO
    Commented Sep 24, 2019 at 15:58
  • updated post with a picture of the qualys headers. The results of wget -d and wget both have the same response: <a href="/asection/index.cfm?param=Some Param&%22%3E%3Cqss%3E=" class="current">
    – roms
    Commented Sep 24, 2019 at 17:11
  • It could be how they process their info then, it might be a bug in how it's reported - best off reaching out to Qualys perhaps
    – LTPCGO
    Commented Sep 24, 2019 at 19:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .