# How to use XSS vulnerability to read file on server?

Can I use an XSS vulnerability to read files on the server by injecting PHP code to the page? Ex: Use document.write to inject PHP code that read the file.

• Welcome to Security.SE. XSS will not be able to accomplish what you are describing, in the way you are describing it. Are you referring to another vulnerability instead of XSS? – h4ckNinja Jul 14 '16 at 6:33

No. XSS makes it possible to run Javascript in a browser of another user. This makes it possible to do request on behalf of that user. Since the code is only run in the browser, you cannot use PHP code.

If you have XSS and you want to run code on the server, the best approach would be to steal the cookies of a logged in administrator using XSS, and use the admin interface to further gain access to the server. Stealing cookies with XSS does not work if the cookie is marked as httponly, because then you can't read the cookie with Javascript.

There is a variant of XSS, sometimes called "Server-side cross-site scripting". It is much less common than client-side XSS. In fact, I have only seen it once on a live web site.

It occurs when the server renders HTML documents. This can happen when the server produces a PDF (e.g. a printable invoice) and HTML is part of the chain. If the attacker can inject tags into this HTML, they can reference local resources on the server. In the example I saw, it was only possible to include images, but variants may allow including other file types.

Some people may argue that this is not XSS. It is an example of CWE-610: Externally Controlled Reference to a Resource in Another Sphere. Other examples would be XML External Entities and external references from Word or SVG documents. I think "Server-side XSS" is a reasonable name for it, but I'm open to other suggestions.

You are mixing up scripts that run on the server, and scripts that run on the client.

When you do XSS, you inject script on the client. Usually it is JavaScript, but it could be VBScript or some other client scripting language.

You can not use document.write to write PHP. That function is JavaScript, and is therefor executed on the client. It writes in the document the client (e.g. browser) is using. Since PHP is run on the server, this will not work.

You could inject PHP code if there is a vulnerability in the server side code that lets you execute code. E.g. if you have something like this

eval(\$_GET['param']);


you could use it to execute arbitrary PHP code and steal files from the server. Such a vulnerability is much more serious than a normal XSS vulnerability, but also much less common.

Lets imagine that there is admin-account in specially crafted webapp and that account has rights to get certain files from server (like, if admin requests /getfile.php?filename.txt, the getfile.php returns content of "filename.txt"). Then you could inject ajax-request to admin's client side and request files with that.