3

Trying to learn about security I set up the most simple website on my localhost consisting of one html page that a apache server serves. I first started trying and appending the JS script that would be executed to the end of a URL:
/index.html?message=<script>alert('XSS');</script>

Browser encodes it to:

/index.html?message=%3Cscript%3Ealert(%27XSS%27);%3C/script%3E

My understanding of the way this kind of attack vector should work is that attacker sends a similar URL to the victim -> victim clicks on it -> the script gets executed (not sure on the exact moment it should be executed?)

Questions:

  1. Why doesn't it get executed?
  2. How to make it execute?
  3. What are the prerequisits of such an attack - maybe it is not enought just to have a simple web page?
  4. When should this script be executed? After the DOM loads?

General explnation on how this should work would also be much appreciated. Thank you!

  • dont use chrome, or any modern browser. the default browser of kali allows for reflected xss to be easily tested – KDEx Sep 20 '14 at 3:28
  • @KDEx - thanks. Is my browser the only issue? Do you have any recomendations on windows browsers that do not protect agains URL JS scriopts? Or linux ubuntu? – Mindaugas Bernatavičius Sep 20 '14 at 7:21
  • I use iceweasel. Ive heard good thing about owasp mantra – KDEx Sep 20 '14 at 14:25
4

XSS attacks are based upon the fact that input becomes output to the end-user's browser. The most common attack is basically a PHP site containing

<?php
echo $_GET["message"];
?>

You would then pass this URL a parameter containing the javascript code. If you want to set this up, create a something.php file on your web server, input the above code into it and then access http://your-server/something.php?message=<script>alert('XSS');</script> in your browser. It should then display a popup containing XSS.

In a static HTML page, this is not possible, as it only generates content based on the server's static HTML code. XSS needs user-supplied code inclusion. The exclusion is, if the html loads a vulnerable javascript code, that allows user-supplied input.

The primary point of XSS is that an attacker wants to include HIS code to YOUR website, without actually hacking the web server. This is only possible with server-side programming languages, which output something, the attacker previously put into the server.

Basically the hacker wants the HTML to look to the browser like this

<html><body>Foo<script>alert('XSS');</script></body></html>

instead of

<html><body>Foo</body></html>

Think for example of a forum or comments on an article. The user should be allowed to leave his remarks. The server needs to save this and present the same comment to other users. If the comment itself contains javascript code and the server program does not mitigate this, it would output the same code as part of the comment block.

As to when this is loaded in the browser, this is not easy to answer. It depends on where the hacker's code is included in the page body or the subsequently loaded javascript files. If it is included as a javascript tag in the main HTML, it will be loaded after the DOM load was completed. Especially as mentioned before, the XSS vulnerability could also happen inside a javascript file (which takes user input, for example a URL and loads it). In this case it is not possible to say, when exactly the code will execute. You could bind this javascript code to a button, a textbox onblur() event or a timer.

EDIT:

Elaborating on the javascript attack, here's what you would put into your server file

<html><body>
<script type="text/javascript">
    var queryDict = {};
    location.search.substr(1).split("&").forEach(function(item) {queryDict[item.split("=")[0]] = item.split("=")[1]});
    document.write(decodeURIComponent(queryDict["message"]));
</script>
</body></html>

The first two lines, bascially take all GET parameters and split them into an array (taken from here). The third line then simply outputs this into the HTML page. Of course this could also be done by any other DOM manipulation from the executed code.

  • Also of course, Wikipedia has a good deal of information about this topic. – Spacy Sep 20 '14 at 9:26
  • Thanks! I actually realized the answer to the 1st and the 2nd questions about an hour ago. It is possible to simulate the attack with JS only - you just have to have JS which parses the URL GET parameters and changes HTML accordingly. I will gladly accept your answer though as it cleared my thoughts on the 4th question! :) – Mindaugas Bernatavičius Sep 20 '14 at 9:29
  • Sorry, wrong again. You where describing a reflected attack that uses server side dynamic rendering - the PHP is taking the URL and rendering it to the HTML. What I was describing is actually a DOM based XSS attack. ... it does not use the server side at all ... :) – Mindaugas Bernatavičius Sep 20 '14 at 10:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.