4

I am trying to build an XSS scanner using Python for a website. The website has widget creation feature. The source code for the website has templates for each widget type. The website returns an API response for each POST call to create widgets, which is then fetched by javascript to populate the widget template with data.

Working of general XSS scanners: Normally XSS scanners detect XSS by sending special characters and javascript keywords such as >,<,script,",etc in the payload/URL and then monitoring the html response to check if the characters are encoded or filtered. If the characters are not encoded/filtered, then the entire XSS vector is sent. If it is exactly reflected in html response, then we have an XSS vulnerability on the page.

Problem Statement: The problem with the website which I am working on is that I get an API response instead of html. The API response contains the injected payload but has all the special chars in encoded format, but it shows up in the page source of UI without encoding,which triggers XSS. If I try to fetch the html of webpage using a GET call, then I get the html of the webpage but it has empty templates and no data in it.

Is there a way through which the problem can be overcome? I can take care of the coding part, but I am not able to figure out how to proceed with this problem. A general idea of how to proceed will help.

1

In this case the XSS is actually independent of the server side, which means you can actually ignore sending data to the API and instead focus on the UI. This means you could essentially write an XSS scanner that mocks the API, and then detect changes in the browser. You could use webdriver/selenium or similar to drive the browser.

Another alternative could be to use phantomjs, have it render the response, and then grab the full HTML from that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.