Complete Beginner's Guide to XSS(with Pics) 06-09-2013, 11:17 AM
#1
Note: I will not teach you anything about Cookie Stealing or defacing a website.
What is XSS?
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy. Cross-site scripting carried out on websites accounted for roughly 84% of all security vulnerabilities documented by Symantec as of 2007.
The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack site, in a manner that executes a fragment of JavaScript prepared by the attacker in the security context of the targeted domain (a reflected or non-persistent XSS vulnerability).
Types of XSS
There is no single, standardized classification of cross-site scripting flaws, but most experts distinguish between at least two primary flavors of XSS: non-persistent and persistent.
Non-persistent
The non-persistent (or reflected) cross-site scripting vulnerability is by far the most common type.These holes show up when the data provided by a web client, most commonly in HTTP query parameters or in HTML form submissions, is used immediately by server-side scripts to parse and display a page of results for and to that user, without properly sanitizing the request.
Persistent
The persistent (or stored) XSS vulnerability is a more devastating variant of a cross-site scripting flaw: it occurs when the data provided by the attacker is saved by the server, and then permanently displayed on "normal" pages returned to other users in the course of regular browsing, without proper HTML escaping. A classic example of this is with online message boards where users are allowed to post HTML formatted messages for other users to read.
JavaScript and HTML?
JavaScript
JavaScript (JS) is an interpreted computer programming language.It was originally implemented as part of web browsers so that client-side scripts could interact with the user, control the browser, communicate asynchronously, and alter the document content that was displayed.(source: Wikipedia)
Most of your attacks will be tested with JS queries.
HTML
HyperText Markup Language (HTML) is the main markup language for creating web pages and other information that can be displayed in a web browser.
HTML is written in the form of HTML elements consisting of tags enclosed in angle brackets (like <html>), within the web page content. HTML tags most commonly come in pairs like <h1> and </h1>, although some tags, known as empty elements, are unpaired, for example <img>. The first tag in a pair is the start tag, and the second tag is the end tag (they are also called opening tags and closing tags). In between these tags web designers can add text, tags, comments and other types of text-based content.
(source: Wikipedia)
In the next 2 - 3 examples I will introduce you to the basics of XSS.
Example 1.
This is our first example. I will always start with this query so that I can see what is filtered and what isn't.
Try to find website that has search box, or any kind of text box where you can inject your script.In the next examples we will use search box. I found mine, entered query and press Search/Go/etc. .(Figure 1. and Figure 2.)
Figure 1.
![[Image: step_1.jpg]](http://s20.postimg.org/ic9jiz9l9/step_1.jpg)
Figure 2.
![[Image: step_2.jpg]](http://s20.postimg.org/sjs2vdvt9/step_2.jpg)
Now you may didn't get pop-up box, but that's fine. Let's see our source code and see why did we get pop-up box.(Figure 3.)
Figure 3.
![[Image: looking_at_source.jpg]](http://s20.postimg.org/noydx3xhp/looking_at_source.jpg)
As you can see our query is underlined with red line.(and will always be in this thread). But why did we get pop-up box. Well answer is simple.
Our code was not filtered in any way and we could run our script.In the next examples we will have to bypass filtrations.
In Figure 4. you can see how filtrated code looks like.
Figure 4.
![[Image: encoded.jpg]](http://s20.postimg.org/c14c2k8ct/encoded.jpg)
In this example, ", <, and > characters were encoded in XML encoding. Sometimes they will be encoded in HTML encoding, or will be removed.
Example 2.
So again we will try to enter our query(same as in Example 1.) in search box and press Search/Go/etc. .(Figure 5.)
Figure 5.
![[Image: step_1.jpg]](http://s20.postimg.org/edgxdwabx/step_1.jpg)
But we didn't get pop-up box saying Hello. That's because we need to bypass some filtration.Let's see the source code.(Figure 6.)
Figure 6.
![[Image: loooking_at_source.jpg]](http://s20.postimg.org/vtb3fl9al/loooking_at_source.jpg)
As you can see our query is located between title tags and our quotes were filtered and interpreted as input.What now? Here's solution. We should close title tags and try to avoid quotes. Well it's simple to close title tags, in our basic script, at beginning we should add </title> so our query would look like this.
That's fine but not good enough. We still have to avoid quotes. We would do that by using String.fromCharCode encoding. Here is link where you can do that.Just select Javascript (String.fromCharCode, unescape) and enter your code that is inside alert. In our example that would be "Hello".(with quotes).
And at the end our query would look like this.
As you can see we escaped title tags, we didn't used quotes and at the end we added // so that everything in that line after that would be interpreted as comment.
And we get our pop-up box saying Hello. Let's see source code. (Figure 7.)
Figure 7.
![[Image: runable_source.jpg]](http://s20.postimg.org/7jb81y72l/runable_source.jpg)
Example 3.
In this example, we will see other examples, and where else your query can be located. In Figure 8. our query is located in value tag and ", < and > were not encoded and that is great, because we can escape value tag and then run our script.
Figure 8.
![[Image: in_value.jpg]](http://s20.postimg.org/u1mpyffbh/in_value.jpg)
So how to escape value? We should close value tag, it's that simple. Here is the code.
At beginning of our query we added "> and that will close value tag.Then or script comes in and at the end // so that everything in that line after that would be interpreted as comment.And here is the source code.(Figure 9.)
Figure 9.
![[Image: in_value_soruce.jpg]](http://s20.postimg.org/f9mlktyrx/in_value_soruce.jpg)
Sometimes our query is already located between script tags, so we can remove our script tags from our script.And then our query would look something like this.
This is just an example, but it will not always look like this. In Figure 10. you can see how query in script tags lookalike.
Figure 10.
![[Image: source_in_javascript.jpg]](http://s20.postimg.org/mkdij7psd/source_in_javascript.jpg)
And sometimes our query is filtered/encoded in some places and in other places it isn't. In Figure 11. you can see that in title tags our query isn't filtered and in value tag it is filtered.
Figure 11.
![[Image: looking_at_source.jpg]](http://s20.postimg.org/twnk2hxe5/looking_at_source.jpg)
What is XSS?
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy. Cross-site scripting carried out on websites accounted for roughly 84% of all security vulnerabilities documented by Symantec as of 2007.
The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack site, in a manner that executes a fragment of JavaScript prepared by the attacker in the security context of the targeted domain (a reflected or non-persistent XSS vulnerability).
Types of XSS
There is no single, standardized classification of cross-site scripting flaws, but most experts distinguish between at least two primary flavors of XSS: non-persistent and persistent.
Non-persistent
The non-persistent (or reflected) cross-site scripting vulnerability is by far the most common type.These holes show up when the data provided by a web client, most commonly in HTTP query parameters or in HTML form submissions, is used immediately by server-side scripts to parse and display a page of results for and to that user, without properly sanitizing the request.
Persistent
The persistent (or stored) XSS vulnerability is a more devastating variant of a cross-site scripting flaw: it occurs when the data provided by the attacker is saved by the server, and then permanently displayed on "normal" pages returned to other users in the course of regular browsing, without proper HTML escaping. A classic example of this is with online message boards where users are allowed to post HTML formatted messages for other users to read.
JavaScript and HTML?
JavaScript
JavaScript (JS) is an interpreted computer programming language.It was originally implemented as part of web browsers so that client-side scripts could interact with the user, control the browser, communicate asynchronously, and alter the document content that was displayed.(source: Wikipedia)
Most of your attacks will be tested with JS queries.
HTML
HyperText Markup Language (HTML) is the main markup language for creating web pages and other information that can be displayed in a web browser.
HTML is written in the form of HTML elements consisting of tags enclosed in angle brackets (like <html>), within the web page content. HTML tags most commonly come in pairs like <h1> and </h1>, although some tags, known as empty elements, are unpaired, for example <img>. The first tag in a pair is the start tag, and the second tag is the end tag (they are also called opening tags and closing tags). In between these tags web designers can add text, tags, comments and other types of text-based content.
(source: Wikipedia)
In the next 2 - 3 examples I will introduce you to the basics of XSS.
Example 1.
This is our first example. I will always start with this query so that I can see what is filtered and what isn't.
Code:
<script>alert("Hello");</script>Try to find website that has search box, or any kind of text box where you can inject your script.In the next examples we will use search box. I found mine, entered query and press Search/Go/etc. .(Figure 1. and Figure 2.)
Figure 1.
Figure 2.
Now you may didn't get pop-up box, but that's fine. Let's see our source code and see why did we get pop-up box.(Figure 3.)
Figure 3.
As you can see our query is underlined with red line.(and will always be in this thread). But why did we get pop-up box. Well answer is simple.
Our code was not filtered in any way and we could run our script.In the next examples we will have to bypass filtrations.
In Figure 4. you can see how filtrated code looks like.
Figure 4.
In this example, ", <, and > characters were encoded in XML encoding. Sometimes they will be encoded in HTML encoding, or will be removed.
Example 2.
So again we will try to enter our query(same as in Example 1.) in search box and press Search/Go/etc. .(Figure 5.)
Figure 5.
But we didn't get pop-up box saying Hello. That's because we need to bypass some filtration.Let's see the source code.(Figure 6.)
Figure 6.
As you can see our query is located between title tags and our quotes were filtered and interpreted as input.What now? Here's solution. We should close title tags and try to avoid quotes. Well it's simple to close title tags, in our basic script, at beginning we should add </title> so our query would look like this.
Code:
</title><script>alert("Hello");</script>That's fine but not good enough. We still have to avoid quotes. We would do that by using String.fromCharCode encoding. Here is link where you can do that.Just select Javascript (String.fromCharCode, unescape) and enter your code that is inside alert. In our example that would be "Hello".(with quotes).
And at the end our query would look like this.
Code:
</title><script>alert(String.fromCharCode(34,72,101,108,108,111,34));</script>//As you can see we escaped title tags, we didn't used quotes and at the end we added // so that everything in that line after that would be interpreted as comment.
And we get our pop-up box saying Hello. Let's see source code. (Figure 7.)
Figure 7.
Example 3.
In this example, we will see other examples, and where else your query can be located. In Figure 8. our query is located in value tag and ", < and > were not encoded and that is great, because we can escape value tag and then run our script.
Figure 8.
So how to escape value? We should close value tag, it's that simple. Here is the code.
Code:
"><script>alert("Hello");</script>//At beginning of our query we added "> and that will close value tag.Then or script comes in and at the end // so that everything in that line after that would be interpreted as comment.And here is the source code.(Figure 9.)
Figure 9.
Sometimes our query is already located between script tags, so we can remove our script tags from our script.And then our query would look something like this.
Code:
');alert("Hello");This is just an example, but it will not always look like this. In Figure 10. you can see how query in script tags lookalike.
Figure 10.
And sometimes our query is filtered/encoded in some places and in other places it isn't. In Figure 11. you can see that in title tags our query isn't filtered and in value tag it is filtered.
Figure 11.
Always look at the source code. If you wanna be good at this, learn JavaScript and HTML.
Recommened:
XSS - Cross Site Scripting [Video Tutorial] by Xecutor (videos from Infinity Exists)
Basic XSS tutorial by Anima Templi
Complete XSS Tutorial by 1234hotmaster
We came to the end of this tutorial. :dance: :dance: :dance:
I hope you like it.
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
![[Image: 946696_301886219956429_1080285596_n.jpg]](https://fbcdn-sphotos-g-a.akamaihd.net/hphotos-ak-ash3/946696_301886219956429_1080285596_n.jpg)
