XSS
Last updated
Last updated
📚 What Is XSS ?
🤔 Why XSS Happen ?
🧬 XSS Types
⚔ Impact
🔎 How To Find
🛺 Automate
🛠 Tools
📕 Referance
🔬 Labs
Cross-site scripting (also known as XSS NOT CSS) is a Client-side website web security vulnerability that allows an attacker to compromise users' interactions with a vulnerable application. Cross-site scripting works by manipulating a vulnerable website so that it returns malicious JavaScript to users.
XSS happens because the developer trusts more users and doesn’t put any validation or sanitization for every input that reflects in HTML code or stored in the database and back again to display in HTML code or DOM code like source and sinks
The first type, RXSS, happens when the malicious script comes from the current HTTP Request.
Example-1:
Parameter Search Reflected in this HTML page:
source code found that it doesn’t encode any special characters like <,>,’,”.
Ensure that any HTML tag will work like a bold tag.
Try to execute XSS using script tag bingo it works well This is Reflected XSS
The second type is SXSS happens when the malicious script comes from the website’s database.
Example-2: So as we said Stored XSS should be saved in the database first to achieve this type of XSS.
enter values in a comment, name, email, and website press “Post Comment”
On this page there are two input data saved name and comment
The third type is a Blind XSS is a type of Stored XSS in which the attacker’s input is saved by the server and is reflected in the developer’s application. Basically, the attacker’s payload is executed on the application used by team members or admins.
Normally all use XSSHunter for finding Blind XSS. There are more tools available on the Internet that are: Burp Collaborator, KnoXSS, bXSS Hunter, and many more.
The fourth type is where the vulnerability exists in client-side code rather than server-side code.
Self Cross-site scripting (XSS) is a vulnerability in web applications that gives the ability to execute JS as the same user and not to other users.
Severity: 1.Self-XSS only=>Low, 2.Self-XSS + escalation=>Low-medium
it may be Reflected, Stored, and DOM
in the end, there are many Q&A from Portswigger
Reflected XSS arises when an application takes some input from an HTTP request and embeds that input into the immediate response in an unsafe way. With stored XSS, the application instead stores the input and embeds it into a later response in an unsafe way.
Self-XSS involves similar application behavior to regular reflected XSS, however, it cannot be triggered in normal ways via a crafted URL or a cross-domain request. Instead, the vulnerability is only triggered if the victim themselves submits the XSS payload from their browser. Delivering a self-XSS attack normally involves socially engineering the victim to paste some attacker-supplied input into their browser. As such, it is normally considered to be a lame, low-impact issue.
There is a reason why it has been in OWASP for 2013 and 2017. XSS can have huge implications for a web application and its users. User accounts can be hijacked, credentials could be stolen, sensitive data could be exfiltrated, and lastly, access to your client computers can be obtained.
the easiest way to find XSS is through your recon
By using this bash script
Useing Burp Scanner & Acunetix
Most tools are also suitable for blind XSS attacks:
Learn JavaScript From
You can know more about .
Filter all URLs using
Use to classifiy your paramters
Now use to find any URL parameter that is vulnerable
Now you can use to create your POC for any XSS found
All these three ways to find XSS 90% will be duplicated because there are a lot of people who do that before you I prefer to do this manually with each parameter and enumerate for hidden parameters using tools like ,, and .
: Very popular but unfortunately not very well maintained
: Utilizes a headless browser to detect XSS vulnerabilities
to find any URL parameter that is vulnerable
: Extensive functionality and extremely fast thanks to the implementation in Go
: Similar to Dalfox but based on Ruby
: Headless Chrome XSS Tester
From 29Ep : 35Ep
: Install this Machine and will have a lot of Labs like DVWA, BWAPP and Webgoat etc
