#XSS

126 messages · Page 1 of 1 (latest)

dry mauve
steel patio
#

Have you worked with XSS before?

#

The input from the text box gets reflected onto the HTML

dry mauve
dry mauve
steel patio
#

You can't interact with <script> tags

dry mauve
#

For me it looks like this

steel patio
#

What html elements can you interact with, and how could you use those to open an alert()?

dry mauve
#

With <script> ?

steel patio
#

Is that a rendered element?

dry mauve
#

xD hmmm

#

Oh u used a button?

steel patio
#

I did not

dry mauve
#

Hmm

steel patio
#

What other elements are there in HTML?

#

Other than <script>?

dry mauve
#

Uhm idk maybe <a>?

steel patio
#

How could you make that interactible?

dry mauve
#

Does onClick work?

steel patio
#

It's a reflected XSS :)

#

Why don't you test that theory out?

dry mauve
#

I do now :D

steel patio
#

What's the end result?

dry mauve
#

Nice worked! Ok

#

For task 2 I have to find then something which open alert in css right?

steel patio
#

String escaping

#

Don't try to do XSS before you've inspected what the code does

#

How the elements are made

#

I did some magic there to hide the payload I used so you'd have to think about it a bit

dry mauve
#

Hm is the css relevant? I mean cant I just do the same like in Task 1?

steel patio
#

Inspect element is your friend here

#

Try doing a normal name and color to see what it does

dry mauve
#

Ohhh it creates a <a> with my given style

steel patio
#

Figuring things out?

dry mauve
#

Yes I got it I think

#

Color: green" onClick="alert(1)

steel patio
#

Does that work?

dry mauve
#

Yes

#

Okay task 3 is a bit more difficult

#

I got maybe an idea

#

Or not xD. But I know that the result is saved with save() for every input. So I would have to insert the alert somehow for every input, but I don't know how.

steel patio
#

Persistency get

image.png
#

Look at what the function is doing

dry mauve
#

You mean this one?

steel patio
#

JS function

dry mauve
#

Oh ok let me look hmm

steel patio
#

It's not too difficult to get the payload working once you figure it out

#

Did you pick a selection, hit submit, and refresh/reload the page?

#

Or visit some other site and come back to it?

steel patio
#

But the last sentence on that is not necessary

dry mauve
steel patio
#

Did you check the js?

dry mauve
steel patio
#

How's the answer stored?

#

It's a non-sanitized string

dry mauve
#

Solution?

steel patio
#

What's the line handling that?

dry mauve
#

If (solution) {
localStorage.setItem('the_solution', solution);
}

steel patio
#

On the right tracks, how'd you abuse that in your XSS injection using the Free Injection box?

#

And it's a single line handling the save

dry mauve
#

Uhm just with setting the solution to alert(1)

steel patio
#

Does that work?

#

And what would the payload look like?

#

Keep in mind you have to use the Free Injection textbox

dry mauve
steel patio
#

What did you try as a payload?

#

There's few ways of doing that

dry mauve
#

I just tried simple solution = alert(1)

steel patio
#

Oofff

dry mauve
#

But thats wrong

#

Hahahha

steel patio
#

What's the line handling the saving of the solution?

dry mauve
steel patio
#

That's 3 lines

#

Not 1

dry mauve
#

LocalStorage ...

#

LocalStorage.setItem('the_solution', solution);

#

This

steel patio
#

Yup

dry mauve
#

Oh so maybe

#

No

steel patio
#

What did you attempt?

dry mauve
#

I thought I can try LocalStorage.setItem('the_solution', alert(1));

steel patio
#

Be wary for typos

#

LocalStorage isn't how that line is in the code

#

You're gonna need more than just that line

dry mauve
#

Hmm I dont get it

steel patio
#

LocalStorage

vs

localStorage

#

But, you're gonna need extras to run that

dry mauve
#

LocalStorage.setItem('the_solution', alert(1))

steel patio
#

Capitalization again

dry mauve
#

wait xD

#

localStorage.setItem('the_solution', alert(1))

#

now?

steel patio
#

Test it out

dry mauve
#

no didnt work

#

it displays still the same answer which I submitted

#

oh wait hmm thats weird

#

I tried <script>localStorage.setItem('the_solution', alert(1))</script> now but the alert first is looking like that:

#

an after pressing on ok the website is loaded

#

is that normal?

steel patio
#

Check the JS again

#

It's getting the solution in an onload event

#

Which fires when the page loads

dry mauve
#

yes

#

I have to change that then

#

hmm I cant do anything against that can that be?

steel patio
#

You can inject new elements

dry mauve
#

what is the point if 'the_solution' is always loaded onload anyway?

steel patio
#

Fancier injections

#

And you can get the full site to load before the payload gets triggered

dry mauve
#

But the task would theoretically already be finished, wouldn't it?

steel patio
#

Yup

#

If you got persistency

#

Without malicious url

dry mauve