1

I'm trying to create a vulnerable sandbox environment for pentesting challenges. As part of the challenge, I want to include some elements of XSS or SQLi if possible. However, I do not wish to make this too easy either.

I built a web server hosting a simple website of mine. In my codes, I used the following as a simple input validation trick I've read up somewhere.

if(isset($_POST["name"]) && !empty($_POST['name'])){
$_POST['name']=validate_input($_POST['name']);
}

function validate_input($data){
    $data=trim($data);
    $data=stripslashes($data);
    $data=htmlspecialchars($data,ENT_QUOTES,'UTF-8');
    echo $data;
    return $data;
}

Any ideas on how a hacker can bypass this?

Improve this question

1 Answer 1

Reset to default
2

First off, "input validation" is when you say "the input needs to match a certain format" and reject otherwise, like:

if !is_phone_number($input) {
   return400();
}

What you are showing is not input validation, it's output escaping. Specifically php's htmlspecialchars() is making the data safe to output directly into an HTML document.

I feel like you're missing the second half of your code how you are using this input. To be HTML XSS you have to inject this input into an HTML context (which you have escaped for, so that probably won't work, assuming php's htmlspecialchars() is done properly), or inject it directly into a javascript context, or a Kendo template, or something.

To be SQLi you have to use it to construct an SQL statement.

If you want to make this vulnerable to XSS, but in a subtle way, I would do the following:

Set the ENT_NOQUOTES option to htmlspecialchars() so that single and double quotes are left un-encoded.

Then use this input directly in a javascript blob, for example return this HTML page:

<html>
 <head>
 </head>
 <body onload='document.title = "$data"'>
   <h1>Nothing to see here...<h1>
 </body>
</html>

Now, because you have excluded quote and double-quote un-escaped, the following input:

";alert(1)

will result in your server rendering and serving the following html:

<body onload='document.title = "";alert(1)'>

which will pop the alert box (or whatever other javascript payload you put in).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .