HACKING JULY DAY 20: DVWA EXPLOITATION #2

Today's Challenge

Today's challenge is stored cross site scripting on DVWA.

Stored XSS occurs when one visits a compromised web page that serves a malicious script to their server.

For this challenge I will use a script that changes the title of the web page for educational purposes.

The vulnerability

Stored XSS

Stored XSS

The exploitation

Low

I will use a simple script

<script>document.title = "PWNED - "</script>

<script>document.title = "PWNED - "</script>

As seen from the PHP source code, the message section will remove back slashes which will have no effect on our payload.

The name does not have any sanitization code.

Once I input the payload in the message section, the page's title changes and that will happen to everyone who visits that page.

The script is embedded into the pages html code.

Medium

At medium security level, the message section strips all tags while the name section replaces/removes 'script'.

Both sanitisation methods affect our code.

The loophole comes in when we consider that using lower cases in HTML is just good practice, not mandatory — I can use uppercase letter in our html payload and it will work in the name section.

The name section sanitizes 'script' and not any other alteration of the same word. Cases don't matter in HTML

But then I noticed that the name section has a length, I will have to use another tool in between which is Burp Suite.

I will intercept the request, add the payload then send it.

I have altered the title a little bit for clarity.

High

At high security level, the message section strips off the tags while name section strips any form of the word 'script'

I will use a different payload here, an event handler.

<img src="x" onerror="document.title='DueTime'">

<img src="x" onerror="document.title='DueTime'">

The payload will be inserted in the name section the same way we did with medium security level — via Burp Suite after an intercept.

I really appreciate your time and attention.