1

I am trying to learn about of xss attack and so I far, I understood that a successful attack result in the attacker capable of injecting malicious js in the victim's browser. If my understanding is correct, this attack will give him access to browsing data of a compromised domain only. For example, if the compromised domain is example.com attacker will have access to cookies and local storage .... of example.com

But so far, injected code executes immediately. Is it possible that an attacker injects a code that

  1. Permanently eavesdrops the user HTML code and browsing activity on that single domain

  2. Execute some malicious code at a later time or when a condition is met? (for example, if user balance > $999 assuming example.com is an internet banking app?

If this is possible, where does the attacker store the js code? I am looking for what keywords should I google about this code of exploit.

1
  • 1
    Look into "stored XSS" Sep 6 '20 at 10:08
2

If I understand your question correctly, you are asking how to persistently compromise a whole domain with XSS, and not just a single page, to be able to execute malicious code in every page at any time.

Suppose you have one page, vulnerable-page.php, where you can inject JS code persistently, that is, every time a user loads the page the malicious code will be executed. If the victim visits non-vulnerable-page.php though, your code won't be loaded. There might be some tricks you can use anyway, for example you can make vulnerable-page.php look and behave like non-vulnerable-page.php, so the victim will think they are on non-vulnerable-page.php while in reality they are still on the vulnerable page. You could even expand this concept and devise a kind of front-end proxy, so that the victim will think they are browsing the website, while in reality they are always staying on the vulnerable page (the vulnerable page will load the content of the other pages with AJAX, and maybe also change the path in the address bar). You can use similar clever tricks to obtain the information you want, but your mileage may vary.

Now suppose you find a stored XSS vulnerability in the footer of a website, and that footer is included in every page: home page, articles, login page, admin panel, etc. In this case you will be able to inject your code everywhere all the time, and therefore execute any JS you want, wherever and whenever you want.

In several cases though, an attacker doesn't need to be able use XSS in every page to be able to compromise a website completely. For example, the attacker can make a logged-in admin visit a single compromised page on the website: that page might send an AJAX request to change the attacker's privileges (upgrading the account from "guest" to "admin"), and from that point on the attacker will just be able to do whatever they want from the admin panel (including installing malicious modules, changing files, etc.). This is just an example to show you that often a single vulnerable page can still lead to complete compromise.

1

There are a 3 main types of XSS.

  1. Reflected XSS: This is the kind that you are describing that results from malicious script being injected into the returned HTML page and executing immediately.
  2. Stored XSS: This is the kind where the malicious script is being injected into the server side application. Every time a user visits the page, the XSS is executed. This kind is generally more serious.
  3. DOM-based XSS: This kind is only possible if the client-side scripts can write data provided by the user directly to the DOM. As the payload is never sent to the server, it's also not logged making this kind hard to detect.

Read more about them here.

If we just consider just the two you're asking about:

Is it possible that an attacker injects a code that permanently eavesdrops the user HTML code and browsing activity on that single domain.

How about a Keylogger that stores all keystrokes along with timestamps in an array and sends it to the attacker controlled server over HTTP every 200 milliseconds

Is it possible that an attacker injects a code that executes some malicious code at a later time or when a condition is met? (for example, if user balance > $999 assuming example.com is an internet banking app?

Basically, any sort of Javascript can be executed so the possible attacks are fairly broad in scope. Javascript can definitely execute conditional logic so yes, doable.

// oversimplification
if (balance > 999) {
  bad stuff;
}

where does the attacker store the js code?

Going back to our definitions, if this is a Reflected XSS attack then the malicious script doesn't need to be stored. It's simply injected through crafting a malicious URL as one example.

If it is a Stored XSS attack, the malicious script may be injected into the web applications database, and then every GET request for the page injects the code into the page, as an example.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.