Application blocks most tags, html encoding doesn't escape h1 tag, etv
Restrictions
Searching for "<script alert(1)</script>"
Script tag is blocked, after testings
Need to find what tags and attributes are not blacklisted.
Copy list
Launch Burp Intruder with a insertion between simple tags "<$>".
<body> tag is whitelisted.
Now, need to find usable attributes of tags that would facilitate JS execution.
Blacklisted event onload gives error(400)
Again brute forcing to find whitelisted attributes:
onresize attribute is allowed.
But, the attack needs to be without user interaction.The victim will open a link and payload needs to be triggered, for that we need to resize the window.
So, we can use an
- iframe that will refer to the search result.
- resize the iframe onloading. This will trigger the payload.
Victim final exploit
LAB 4 : Reflected XSS into HTML context with all tags blocked except custom ones
Objective:
This lab blocks all HTML tags except custom ones.
To solve the lab, perform a cross-site scripting attack that injects a custom tag and automatically alerts document.cookie.
Solution:
Custom Tag to exploit xss:
This works on clicking the "A", but need something without user interaction.
In the returned url, put location hash to the id of html element (tag) created.
Exploit victim:
Need to host the refected xss link with location hash to the victim.
The payload must alert document.cookie
Final exploit HTML body.
It redirects the victim (on visit) to vulnerable page that triggers reflected xss
LAB 5 : Reflected XSS with event handlers and href attributes blocked
Description:
This lab contains a reflected XSS vulnerability with some whitelisted tags, but all events and anchor href attributes are blocked..
To solve the lab, perform a cross-site scripting attack that injects a vector that, when clicked, calls the alert function.
Note that you need to label your vector with the word "Click" in order to induce the simulated lab user to click your vector.
For example:
<a href="">Click me</a>
Recon:
searching for <body></body> is error, as it is blocked
Bruteforcing allowed tags
Attacking:
svg was whitelisted, though the events were blocked.
<body> tag is whitelisted.
