the-web-application-hackers-handbook

454 Chapter 12 n Attacking Users: Cross-Site Scripting
Testing Reflections to Introduce Script
You must manually investigate each instance of reflected input that you have
identified to verify whether it is actually exploitable. In each location where
data is reflected in the response, you need to identify the syntactic context of
that data. You must find a way to modify your input such that, when it is copied
into the same location in the application’s response, it results in execution of
arbitrary script. Let’s look at some examples.
Example 1: A Tag Attribute Value
Suppose that the returned page contains the following:
One obvious way to craft an XSS exploit is to terminate the double quotation
marks that enclose the attribute value, close the tag, and then
employ some means of introducing JavaScript, such as a tag. For
example:
“>alert(1)
An alternative method in this situation, which may bypass certain input filters,
is to remain within the tag itself but inject an event handler containing
JavaScript. For example:
“ onfocus=”alert(1)
Example 2: A JavaScript String
Suppose that the returned page contains the following:
var a = ‘myxsstestdmqlwp’; var b = 123; ...
Here, the input you control is being inserted directly into a quoted string
within an existing script. To craft an exploit, you could terminate the single
quotation marks around your string, terminate the statement with a semicolon,
and then proceed directly to your desired JavaScript:
‘; alert(1); var foo=’
Note that because you have terminated a quoted string, to prevent errors
from occurring within the JavaScript interpreter you must ensure that the
script continues gracefully with valid syntax after your injected code. In this
example, the variable foo is declared, and a second quoted string is opened. It
will be terminated by the code that immediately follows your string. Another
method that is often effective is to end your input with // to comment out the
remainder of the line.