Home Unlabelled XSS Persistent with Details

XSS Persistent with Details

By
Friday, January 11, 2013
Read
Add Comment
    What is XSS?
     
    XSS, also known as CSS, stands for Cross Site Scripting. It is a vulnerability where attacker can inject client-side script into Web pages viewed by other users. With it, we can execute JavaScript on the remote machine. JavaScript is very powerful, and I highly recommend you learn it first before attempting XSS. You will understand everything better. By injecting malicious scripts, we can gain elevated access-privileges to sensitive page content, such as cookies, that are kept by the browser. Therefore, we can hijack sessions.
    ==============================================
    What types of XSS exist?
    ==============================================
    Non Persistent
    ====================
    Non persistent is also known as Reflected XSS. When we execute it, it doesn't stay in the page. In order for it to have any effect, we must send the link to the vulnerable page. Our malicious vector has to be in that link. How does reflected XSS work? Simple. Web pages are designed to take input from users. For example, when you search in some search bar, it will say "No results for" + your input.
    Here it reflects what you said. There are a lot of places where page might reflect our input. You are supposed to view source of the code, escape their tags, and open your own.
    ==============================================
    Persistent XSS
    ====================
    XSS vulnerability is persistent, if your malicious script stays on the site where you executed it. For example, if HF had xss vulnerability in threads, if I input malicious vector in thread name, everyone who opens this thread will be infected. It stays there forever. That's why it is called persistent. Attacker doesn't have to include his vector in the url he sends to the victim.
    ==============================================
    DOM Based XSS
    ====================
    DOM-based vulnerabilities occur in the content processing stages that are performed by the client. The name refers to representing HTML or XML contents and that is called the Document-Object-Model ( Therefore, we get DOM).
    ==============================================
    XSS
    ====================
    When searching for XSS vulnerability, your main objective is to get the page to open an alert box. To do that your often have to bypass many HTML tags in that page. Your base script is:
    Every time you do XSS, you are supposed to type that. Then you must look at the source code, see where it reflects out vector, bypass their tags, and alert saying "XSS" will be created. You should switch to Firefox when searching for XSS Vulnerabilities because Chrome has additional filters.
    For the first example, we will be taking
    http://www.osby.se/.
     
    Type
     
    in the main search engine. Nothing happens. Right click on the page>view source code. Press Control+F, and type "alert(0)" to see where page reflects our vector.
     
    This is what I got:
     
           
               
               
               
           
       
     
     
    Our input is being reflect in two places, inside input, under Value="" and inside Form Action. Not let's take a look at what page does. Let's look at
    first. It put a quotation mark, then link to the search bar, and then our content. At the end it finished with putting another quotation mark. So, action equals everything that is under quotation marks. Meaning, if we type our own quotation mark in the search bar, page will think that action="" finishes there. We will have our outside of it.
    Now let's look at the input tag. Our script is reflected under value=""
    This is the same situation. It took our input and put a quotation mark before and after it. If we place our own quotation mark, it will think that value ends there. I'll explain with example:
    Value="Is this vulnerable?" is how it normally looks like. Now let's type this is the search bar:
     
    Is " this  vulnerable?
    Source will now look like this:
    Value="Is" this vulnerable
    This vulnerable is OUTSIDE of value. Meaning that we have successfully escaped it.
    Let's get back to osby site, and exploit the vulnerability. Type " in the search bar, and it will execute and create an alert box.
        " method="post" class="search">
           
               
                " />
               
           
       
     
    We tricked the page into thinking that value ended, and then we entered our malicious script.
     
    Now, let's take popular shopping site Toronto for example. Type in the main search engine. Look at the source. It reflects our input in a lot of places, but I will post only one.
     
       '
     
    This doesn't do anything. But if we take a closer look, we will see that we are inside script tag. What we can do, is close that tag with and open a new one for ourselves. Therefore, the source will look like this:
       '
    It closed their tag, and opened our own. Alert box will pop up saying XSS.
     
    When doing Reflected XSS, you must always keep an eye on the url. Why? Because sometimes you can inject your vector through url, if the page reflects our input. Meaning that you should sometimes paste your vector after you see "=" for example, and you might get and alert box.
    Let's take site Prva.rs for example. While browsing it, I found archive, where it has options to show content from day, month and year.
    http://www.prva.rs/sr/vesti/video.html?day=&month=3&year=2012&Submit=
    So let's inject in the url. Let's look at the source and search for our vector.
  1. &position=1">2
    2. As we can see, href started with ", meaning that we  should close it with our own quotation mark. But after doing just that it won't work. Upon inspecting the source code even more, I found out that we were already inside script tag. Meaning that we must close that as well. Final vector is: "
    This closes their quotation mark, then it closes the script tag, and opens our own.
  2. &position=1">2
    3.  
    We made it close href, then close script, and then open another one with our malicious code.
     
    Filters
     
    We have now learned the basics. But not always will " <> and words Script and alert be allowed. There are many things used to stop us from injecting our vector. I will explain filters you will face in future, and how you can bypass them.
     
    Magic Quotes
     
    When magic_quotes_gpc is on, it means that the server doesn't allow characters: ", / and '
    to bypass it we use :
    String.fromCharCode()
    We write our code, in the () crypted in ASCII
    exemple :
            String.fromCharCode(88,83,83)
    88, 83,83 is "XSS" Crypted.
    And we use it like this:
     
    Let's take http://www.osby.se for example again. In the beginning of the thread we exploited the vulnerability by using "
    Notice how I intentionally used 0 instead of word "XSS". If we just try to change that 0 to some text, "XSS" for example, it won't create an alert box. Why? Because it doesn't allow quotation marks. To bypass that we use:
    "
    We will get an alert box saying XSS.
    We can also bypass it in another way. We can use / instead of ".
    will execute, but it will show // in alert box.
     
    Bypassing with Full HTTP
     
    You can sometimes bypass some filters by encoding your vector in full HTTP. You can use the tool "Coder" to do encode it in full HTTP.
     
    Word Blocking
     
    Sometimes pages won't allow words like "Script" to be typed on the page. When this happens, you should use something else to get alert box. Learn JavaScript if you want to understand this better.
    Let's take site: http://www.frageugen.at/index.php?page= for example.
    http://www.frageugen.at/index.php?page=
    Source will look like this:
    . We can bypass this by using different type of XSS. We will use