HOW is the malicious URL/payload is delivered to the user on a DOM based XSS attack?

Question

Testing for DOM based XSS at OWASP reads:

The first hypothetical example uses the following client side code:

<script>
document.write("Site is at: " + document.location.href + ".");
</script>

An attacker may append #alert('xss') to the affected page URL which would, when executed, display the alert box.

and other sites talk about very similar examples.

The problem is that I cannot find an explanation on HOW the malicious URL/payload is delivered to the user, like how the user can fall victim to this attack since it's a client based attack and requires no server interaction. Is phishing used for DOM XSS as well?

And how does the attacker identify a site with a possible DOM based XSS vulnerability?

Answer 1

The link you mention says that DOM-XSS is the de-facto XSS. This is simply stating that in XSS you are executing scripts (e.g. JavaScript) that are injected into the DOM.

HOW the malicious URL/payload is delivered to the user?

In some cases (reflected XSS) it's phishing: "Hey check out thiswebsit.com?p=[XSS payload]" When the phished user visits the site the script executes in their browser.

In other cases (stored XSS) you may be able to store a script in say, a comment box that is displayed to every other visitor of the site: "Hey this is a great site! [XSS payload]. Now when any user visits the site and your comment is rendered the malicious script is also executed in their browser.

In both cases although you've inserted JavaScript, that payload is not actually visible as text to the end user. The script is however executed in the end user's browser. The script payload may be a simple alert box, it might be a payload that sends their session authentication cookies to a server you control (allowing you to 'login' as them), or a number of other things.

How does the attacker identify a site with a possible DOM based XSS vulnerability?

Burp was already mentioned, this is a great tool.

A very basic way to get started testing/understanding XSS is to ask yourself when viewing a page "What data do I control, and what data is displayed back to me?". If you can test these data points for script injection you are on your way to understanding XSS. Data points that commonly are vulnerable to basic XSS attacks are comments, usernames, profile details, error messages, and search parameters.

Answer 2

I'll answer your second question first. An attacker identifies a DOM based XSS vulnerability just like any other vulnerability, however, they could also use JavaScript analysis tools too as the code is client-side. By probing the site using hacking tools or automated scanners. Automated scanners are not likely to bring up much on the big sites, as they would have already ran these themselves and fixed anything that has come up.

Tools such as Burp can be used in order to manipulate or fuzz parameters, or to analyse the code, and then find out how the site responds.

Regarding how the payload is sent to the vitim... I think your question is regarding all reflected XSS attacks rather than only DOM based reflected XSS. The payload could be sent:

• Via links sent to the victim in a phishing email.
• Via links posted onto a forum that would entice people to click them who have a good chance of being potential victims (e.g. ebay forums for an attack on ebay site itself).
• Redirecting users from compromised websites.
• Paid ads with the XSS URL as the go to location when clicked.

Answer 3

The problem is that I cannot find an explanation on HOW the malicious URL/payload is delivered to the use

For the sake of example, we have an XSS vulnerability on PayPal.

As you've stated, it can be delivered via forms of phishing. A lot of people are aware enough not to type their personal information into a page pretending to PayPal, less people will be afraid of URLs as long as they see "paypal.com"

The attack can be delivered a variety of other ways, I've outlined some examples

• Attacker posts shortened attack URL to a PayPal community forums asking for help with error
• Attacker publishes an ad for sick gains on ad network, it actually links to attack URL
• Attacker has compromised stackexchange.com and redirects all traffic to attack URL.

And how does the attacker identify a site with a possible DOM based XSS vulnerability?

These vulnerabilities are found similarly to others; people spend a lot of time auditing. Including bug bounties, blog traffic, and cyber crime syndicates: there are many ways to profit off of auditing for this kind of stuff.