XSS— TryHackMe

Cross-site scripting (XSS) remains one of the common vulnerabilities that threaten web applications to this day. Cross-Site Scripting (XSS) is a web vulnerability where attackers inject malicious client-side scripts (eg: JavaScript) into trusted websites. It occurs when an application takes user input and includes it in a web page without proper validation, allowing the script to execute in a victim's browser.

As part of my learning journey — and while gaining practical experience during my Cyber Security Internship at Cyber Leelawat — I completed the "XSS" room on TryHackMe to strengthen my Web Exploitation skills.

Learning Objectives:

• Reflected XSS
• Stored XSS
• DOM-based XSS
• How to protect against XSS

Let's get started!

TASK 2: TERMINOLOGY & TYPES

Types of XSS:

• Reflected: Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request.
• Stored: Stored attacks are those where the injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc.
• DOM-based: DOM Based XSS is an XSS attack where the attack payload is executed as a result of modifying the DOM "environment" in the victim's browser. This environment is used by the original client side script, so that the client side code runs in an "unexpected" manner.

Question 1: Which XSS vulnerability relies on saving the malicious script?

Ans: Stored XSS

Question 2: Which prevalent XSS vulnerability executes within the browser session without being saved?

Ans: Reflected XSS

Question 3: What does DOM stand for?

Ans: Document Object Model

TASK 3: CAUSES & IMPLICATIONS

What Makes XSS Possible?

• Insufficient input validation and sanitization
• Lack of output encoding
• Improper use of security headers
• Framework and language vulnerabilities
• Third-party libraries

Implications of XSS:

• Session hijacking
• Content manipulation and defacement
• Data exfiltration
• Malware installation

Question 1: Based on the leading causes of XSS vulnerabilities, what operations should be performed on the user input?

Ans: validation and sanitization

Question 2: To prevent XSS vulnerabilities, what operations should be performed on the data before it is output to the user?

Ans: encoding

TASK 4: REFLECTED XSS

Reflected XSS is a type of XSS vulnerability where a malicious script is reflected to the user's browser, often via a crafted URL or form submission.

Question 1: Which one of the following characters do you expect to be encoded? ., ,, ;, &, or #?

Ans: &

Question 2: Which one of the following characters do you expect to be encoded? +, -, *, <, =, or ^?

Ans: <

Question 3: Which function can we use in JavaScript to replace (unsafe) special characters with HTML entities?

Ans: sanitizeHtml()

Question 4: Which function did we use in PHP to replace HTML special characters?

Ans: htmlspecialchars()

TASK 5: VULNERABLE WEB APPLICATION 1

If we go to http://10.49.172.74:3923, we can see that the target machine is running a vulnerable version of Copyparty.

Copyparty is a lightweight, open-source, and portable file server written entirely in Python. It allows you to instantly turn any device into a local file server that can be accessed through a standard web browser or mounted as a local disk.

There is an XSS vulnerability in this version. The discovered reflected XSS vulnerability has the ID CVE-2023–38501.

There is a parameter k304 which we can exploit to check the presence of XSS. The k304 parameter stands for "Keep 304". It is used internally by the Copyparty web interface to optimize file browsing, handling how the client-side browser should cache and render directories or files.

The issue occurred because when Copyparty rejected or responded to an invalid value supplied to k304, it would echo that exact text back into the page's HTML body without checking for script tags.

We can exploit this parameter by entering a %0D%0A%0D%0A where %0D is a URL-Encoded form of Carriage Return (CR or '\r') and %0A is a URL-Encoded form of Line Feed (LF or '\n') followed by an HTML img payload containing a JavaScript trigger as it's attribute.

HTML Payload: <img src=copyparty onerror=alert(1)>

Because we are entering it into the URL along with encoded value of CRLF, we will encode our HTML payload as well.

Encoded Payload: %3Cimg%20src=copyparty%20onerror=alert(1)%3E

The reason why we add %0D%0A%0D%0A before HTML payload is because in an HTML request, CRLF CRLF (yes, it is entered 2 times) depicts the end of section. Here, two times %0D%0A ends the request headers section and our HTML payload is considered as request body. So our payload gets interpreted as:

That's why our payload is considered as content and it is shown on the webpage and because the src attribute does not contain a valid image source, JavaScript onerror trigger gets executed and alert pop-up is shown.

The complete exploit code is:

?k304=y%0D%0A%0D%0A%3Cimg+src%3Dcopyparty+onerror%3Dalert(1)%3E

Question 1: What type of vulnerability is it?

Ans: Reflected XSS

Question 2: Use the above exploit against the attached VM. What do you see on the second line after go to?

Ans: /?h#cc

TASK 6: STORED XSS

Stored XSS, or Persistent XSS, is a web application security vulnerability that occurs when the application stores user-supplied input and later embeds it in web pages served to other users without proper sanitization or escaping.

Stored XSS begins with an attacker injecting a malicious script in an input field of a vulnerable web application. The vulnerability might lie in how the web application processes the data in the comment box, forum post, or profile information section. When other users access this stored content, the injected malicious script executes within their browsers.

Question 1: What is the name of the JavaScript function we used to sanitize the user input before saving it?

Ans: sanitizeHtml()

Question 2: Which method did we call in ASP.Net C# to sanitize user input?

Ans: HttpUtility.HtmlEncode()

TASK 7: VULNERABLE WEB APPLICATION 2

Upon navigating to http://10.49.174.35, we can see that it is a web application for hospital management.

We are already given the admin credentials to login. Go to receptionist login and enter the credentials given below to login.

• Username: admin
• Password: admin123

After logging in, we see that there are tabs in the admin panel allowing the user to manage the record of doctors, patients, appointments etc.

One of the tabs is "Queries" tab. It seems to hold the record of queries sent through "contact" page of the website.

So, we might be able to enter a payload to trigger Stored XSS. Enter the name, email and mobile number normally. In the message field, we will enter a JavaScript alert within <picture> <source media="(max-width: 768px)" srcset="/img/medium/700/1*mETIp2BBkM3XtYYUbUue6g.png 1x"> <source media="(min-width: 769px)" srcset="/img/medium/2000/1*mETIp2BBkM3XtYYUbUue6g.png 1x"> <img src="/img/medium/700/1*mETIp2BBkM3XtYYUbUue6g.png" alt="None" width="1291" height="737" loading="lazy" data-zoom-src="/img/medium/4000/1*mETIp2BBkM3XtYYUbUue6g.png" class="prose-image"/> </picture>

If we go to admin panel now, we will see the alert that we entered as the message.

What happens here is:

• We enter an html
• Our message gets stored in the server storage / database.
• When the admin panel loads, all the queries are loaded including our message containing the payload.
• As the message was stored without input sanitization, it rendered as html and the script inside the

Question 1: What type of vulnerability is it?

Ans: Stored XSS

Question 2: Go to the contact page and submit the following message <script>alert(document.cookie)</script>. Next, log in as the Receptionist. What is the name of the key from the displayed key-value pair?

Ans: PHPSESSID

TASK 8: DOM BASED XSS

DOM-based XSS vulnerabilities take place within the browser. They don't need to go to the server and return to the client's web browser. In other words, the attacker will try to exploit this situation by injecting a malicious script, for example, into the URL, and it will be executed on the client's side without any role for the server in this.

Question 1: DOM-based XSS is reflected via the server. (Yea/Nay)

Ans: Nay

Question 2: DOM-based XSS happens only on the client side. (Yea/Nay)

Ans: Yea

Question 3: Which JavaScript method was used to escape the user input?

Ans: encodeURIComponent()

TASK 9: CONTEXT AND EVASION

Question 1: Which character does &#x09 represent?

Ans: Tab

TASK 10: CONCLUSION

Question 1: This room used a fictional static site to demonstrate one of the XSS vulnerabilities. Which XSS type was that?

Ans: dom-based xss

Cross-Site Scripting (XSS) remains one of the most prevalent web vulnerabilities which can turn trusted websites into vehicles for malicious scripts. By exploiting the trust a user has in a application, an attacker can bypass modern browser defenses, hijack sessions, and exfiltrate sensitive data.

Thank you.