0

I'm only a beginner so if any more info is needed just request and i'll update the question.

For one of my modules we are covering cross-site scripting and I have been given a series of PHP files that I need to get a script through to print document.cookie to an an alert box. I've spent a while on this one and i'm having some trouble, if someone could help me out.

 <html><head>...</head>

 <?php require_once 'header.php'; ?>
 <?php
      if (isset($_POST["name"])) {
          echo "HELLO ".htmlentities($_POST["name"]);
      }
 ?>

 <form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST">
 Your name:<input type="text" name="name" />
 <input type="submit" name="submit"/>

 </html

I have tried to POST URL encoded payloads and I have read through the PHP manual for htmlentities but they only show examples of injecting JavaScript where the PHP is inserting the POST data into an element already. This code is just writing it to the document and removing the characters < > " ". All other characters are written to the document.

I have also tried manually entering this data into the request headers directly and the same sensitization is done.

All that is in header.php is the cookie being set and the disabling of the browsers X-XSS-Protection.

Any help is much appreciated.

Improve this question
0

2 Answers 2

Reset to default
0

Parts of your code seems to be missing, so I will assume that there are no other instances of $_POST['name'], $_GET['name'], $_REQUEST['name'] or $_COOKIE['name'] in the code. I'm also assuming this isn't tied to a specific PHP version with some specific behaviour.

Unless the name parameter isn't used inside a script tag you don't have an easy way to execute js through the name parameter as you would need to inject a <script> tag and AFAIK there is no bracket <> bypasses for htmlentities(). There is however another injection point that can be used: $_SERVER['PHP_SELF'] which can contain arbitrary values if PATH_INFO is supported by the web server. It may not be the intended solution and I won't give you a complete answer as you're supposed to learn, but a quick google should be enough to get you started.

Improve this answer
1
  • 1
    Thanks man, I got this working! I was speaking to my lecturer to make sure this was allowed he said ye the POST['name'] going through htmlentities() was just to distraction... I fell for it hard haha
    – Anthony
    Commented Oct 30, 2020 at 16:54
0

Try injecting the xss payload directly into the request header.

Improve this answer
1
  • Hey thanks; i'm having the same responses as on the browser. The backend is sanitizing the it before it is being sent back.
    – Anthony
    Commented Oct 29, 2020 at 12:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .