1

I was testing out a stored XSS on a test site I made which is vulnerable so the problem is when I tried executing the usual "><script>alert('XSS')</script>

It did not work instead. But this particular "><script>alert("XSS")</script> javascript works instead.

I did not understand it at first since I did not included any filtering or sanitizing as the back-end code is entirely vulnerable.


But when I tried to look at the back-end SQL query which stores the XSS code as shown below.

UPDATE users set name = 'XSSINPUT';

Based on the above SQL query I managed to understand why the first javascript doesn't work its because its in single quotes hence it closes the SQL query before the whole javascript code is entered and breaks the SQL query as shown below

UPDATE users set name = '"><script>alert('XSS')</script>';

hence this is making it unable to execute the javascript pop-up.


Where as this server-side code below managed to execute successfully

UPDATE users set name = '"><script>alert("XSS")</script>';

because its in double quotes and does not break the SQL query and successfully allows the DB to execute that SQL query.

So, my question is. Is my understanding correct?

1

You are correct. The update statement containing the single quotation mark would be broken due to the termination of the name's value and the ad hoc nature on the update. It is surprising that errors aren't occurring since the extra text after the closing of the single quotation isn't valid SQL.

I have set up an example of both of these cases (as SELECTs since it is easier to set up as an example) which you can find here.

It is doubtful that you don't already know this, but persistent XSS is a fairly severe vulnerability and if you are curious, some of the impacts are highlighted well here.

  • 1
    Yes, Thank you for your help. I do know stored XSS has devastating effects ranging from infecting users and many more. May I ask what is there to learn now what kind of web vulnerabilities should I expand to? Or perhaps you have something you might want to share? Mostly interested in php vulnerabilities. – Cash- May 28 at 9:58
  • Broadly speaking the OWASP top 10 is a good list to start with. Here is a link to their documentation. There are several online resources that dive more deeply in to these topics as well, but you would probably be better off researching the specifics for yourself since you are the best judge of your experience levels in this area. – alert_xss May 28 at 18:38
  • 1
    Thank you for your reply. Is it recommended if I choose a specific vulnerability to specialise and focus on as a hobby or long term career wise etc. Example I love XSS and I like doing online challenges about it and would to expand my knowledge on it more. – Cash- May 30 at 4:29
  • If one is going to be creating reasonably secure online applications then it is necessary to have a fairly broad knowledge of these issues. For example, the SQL you have used above appears to also be vulnerable to SQL injection. There are some automated tools to scan for these type things, but I haven't ever used any of the free ones so I wouldn't be a good resource there. They can be good learning tools though because not only do they help one find issues but some even suggest fixes. – alert_xss May 30 at 11:52
  • Alright , if you are talking about paid ones what web vul scanning tools you recommend? I used to use the good old Acunetix back in 2011 not sure about now since there is so many new tools built in python , and implemented in kali etc. – Cash- May 30 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.