{% extends "introduction/base.html" %} {% block content %}

Cross Site Scripting

What is Cross Site Scripting or XSS?

Cross site scripting or XSS is a form of client side code injection.
In this type of attack the attacker tries to inject malicious script into a trusted site. The malicious script is usually a piece of javascript code, which helps the attacker to perform malicious activities, like redirecting the victim to an attacker site, stealing cookies etc. Some times XSS vulnerability can be chained with other vulnerabilities to create great impact . Talking about XSS, we have 3 different types:

Reflected XSS

Reflected XSS occurs when user input is immediately returned by a web application in an error message, search result, or any other response that includes some or all of the input provided by the user as part of the request, without that data being made safe to render in the browser, and without permanently storing the user provided data.

Stored XSS

Stored XSS generally occurs when user input is stored on the target server, such as in a database, in a message forum, visitor log, comment field, etc. And then a victim is able to retrieve the stored data from the web application without that data being made safe to render in the browser.Blog comments sessions are places which can be vulnerable to stored xss , once a vulnerable xss payload is posted then every user that visits the blog comment session would have the impact of the vulnerability.

DOM XSS

This type of XSS is possible when javascript takes in an user controllable code and passes it to a sink ,for code execution . Examples of sinks are window.location , innerhtml , document.write .When the attacker tries to inject malicious code into a sink , then this type of XSS is called the DOM Xss



This lab will help you to understand the Reflective Type of XSS.

The lab consists of a Search page called FAANG IT.Which helps you to get some information about Facebook, Apple ,Amazon ,Netflix, Google. The user can input one of the companies into the search bar and see the information related to it.

If a user searches for something else , he can see a message saying that the search term is not part of the Company.

What can go wrong Here? Yes, this html page reflects the search query back to the page when the user enters something which is not part of the FAANG.

Exploiting the Reflection of the search query

  • Instead of giving a search term try giving a html tag, <h4 >Hello </h4>.
  • Now you can see that the word Hello has been parsed as a Heading in the page.
  • This shows that the page is able to render the user given html tags.
  • In order to get an xss , the user needs to execute javascript code in the browser.
  • This can be acheived by using a script tag and malicious javascript code.
  • For now let's just use a basic javascript code to alert a text to prove that xss is possible .
    • <script >alert(“xss”) </script >
  • Now when a search query is performed with the above payload you can see that the browser is able to render the script tag and execute the javascript , thus alerting “xss” with a pop up.


This lab a demonstration of a stored XSS vulnerability. The challenge is to change the value of flag that is being stored as a cookie on the user's browser. The user input is taken as a POST parameter in the URL and is displayed on the page. The code tries to escape the user input to prevent XSS attacks, but there might still be a way for the attacker to inject malicious code into the page.

The goal of this challenge is for the attacker to find a way to execute arbitrary JavaScript code on the page and retrieve the data stored in the cookie. The attacker must be able to bypass the escaping mechanism and find a way to inject their own code into the page.

But the problem is <script > tag is sanitised by the server so we have to use another method to bypass this.

<img src=x onerror=alert(document.cookie) >

Try changing the value of cookie set flag=success

<img src=x onerror=document.cookie="flag=success"; >

Now when a search query is performed with the above payload you can see that the browser is able to render the script tag and execute the javascript , thus alerting “xss” with a pop up


This lab is a demonstration of a Reflected XSS

The goal of this challenge is to trigger an alert, User input is being Reflected on script Tag, but the real challenge lies in the fact that all alphanumeric characters are escaped. Can you find way to pop an alert ?



Mitigation


First let's analyse what part of the code has resulted in this vulnerability.
#code in views.py
return render(request,'Lab/XSS/xss_lab.html',{'query': q})

#code in html template
<h3> The company '{query|safe}' You searched for is not Part of FAANG </h3>

In the above code the q variable holds the users input . This input is stored in a variable called ‘query’ , which is sent to a html template which renders a html along with the value of the query.

The query received from the user is considered to be safe which resulted in the template rendering the user input without escaping the input. This can be seen by using the keyword 'safe' in the html template.


What happens without the safe keyword?


Without the safe keyword Django would automatically escape the malicious string in the query context variable.

It does this by passing all string data through Python’s html.escape() function. This function will:


Now talking about the mitigation


  1. Encode the following characters with HTML entity encoding to prevent switching into any execution context, such as script, style, or event handlers. Using hex entities is recommended in the spec. The 5 characters significant in XML.
    • & --> & amp;
    • < --> & lt;
    • --> & gt;
    • " --> & quot;
    • ' --> &# x27;
  2. CSS Encode And Strictly Validate Before Inserting Untrusted Data into HTML Style Property Values
  3. JavaScript Encode Before Inserting Untrusted Data into JavaScript Data Values
  4. HTML Encode JSON values in an HTML context and read the data with JSON.parse
  5. URL Encode Before Inserting Untrusted Data into HTML URL Parameter Values
  6. Implement Content Security Policy
  7. Use HTTPOnly cookie flag

{% endblock content %}