Github

XSS

Cross Site Scripting (XSS)

Cross-site scripting works by manipulating a vulnerable web site so that it returns malicious JavaScript to users. When the malicious code executes inside a victim"s browser, the attacker can fully compromise their interaction with the application.

Types of XSS attacks

  • Reflected XSS

  • Stored XSS

  • DOM-based XSS

Reflected

This happens when the site receives data in a HTTP request and uses said data in the response in an unsafe way.

Overview

  • Check if values that you control are being reflected in any HTML or JS code on the site.

  • Find the context where the value is reflected.

Example

https://remote.com?msg=helloworld

<h1>helloworld<h1/>

It can be seen that the value is being reflected in the response.

An attack would look like this

Stored

In this types of XSS, the site receives unsafe data from a user and stores it.

This data can and most likely will be included in HTTP responses later.

Example

Imagine a comment section. Any user can comment and HTML tags are allowed to be included in the comment.

There, a bad actor could include any JS code that will be executed anytime the page is requested.

From here on out, whenever the page is accessed, the script will be loaded.

DOM-based

XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client side script, so that the client side code runs in an “unexpected” manner. That is, the page itself (the HTTP response that is) does not change, but the client side code contained in the page executes differently due to the malicious modifications that have occurred in the DOM environment.

Example

If the attacker controls the value of the input, they can add any malicious script they want.

List of XSS filter bypasses

Cloudfront

Cloudflare

Misc

PreviousCSRFNextDatabases

Last updated