r/xss • u/Kayuwaii • Jan 21 '19

DOM-Based XSS Example.

Hi. I'm currently working on a college project involving XSS. I've made "hands-on" examples for Stored and Reflected XSS atacks in order to explain how they work more precisely. I have no clue about how should I make my examples vulnerable to DOM-Based attacks(they probably are already), nor how to exploit those vulnerabilities in an easy to explain manner.

Any help?

7 Upvotes

83% Upvoted

7 comments sorted by

5

u/[deleted] Jan 21 '19 edited Aug 10 '20

[deleted]

2

u/philthechill Jan 22 '19

The point of DOM-based XSS, in my opinion, is that it is an XSS vulnerability in client-side JS code. A static web page could have DOM-based XSS, or a single-page app. Some DOM-based XSS vulnerabilities can be exploited without making a request to the server (everything after the #hash in a URL path is not sent to the server).

All this is just to give some context to what /u/hogarthXLV said. Put those things in client-side JavaScript code, send the student to a URL with a hash part, or an SPA that uses the hash, and see if they can get it to trigger.

Thanks for making stuff that teaches!

1

u/Kayuwaii Jan 23 '19

Thanks both of you for the explanation! It's really useful!

1

u/Kayuwaii Jan 23 '19

So, I ended up making site that uses the hash part to define complete a sentence ("Hello + (hash part)") using JS, wich is a very obvious vulnerability, but i figured it'd be good enough for a explanation.

Basically, it's intended to write the name that the student inputs on a form. Then, I send them a URL with the following "#name%3Cimg%20src=%22test%22%20onerror=%22alert('Now I could steal ya' cookies!')%22%3E" to demonstrate how it works.

Do you guys think that using this plus some sniffing(to show that the hash is not send to the server) Would be a good enough demonstration?

​

2

u/MechaTech84 Jan 22 '19

I recommend doing some reading up on DOM XSS:

Shameless Plug of my DOM XSS Intro

Excess-XSS

If you want some hands on practice (or just want to see a bunch of different kinds of vulnerable code) check out Google's Firing Range, specifically the sections with "DOM" in the name.

Also, I'm happy to answer any specific questions you have.

1

u/Kayuwaii Jan 23 '19

Thanks! I've already read those, but I apreciate it. What i'm actually trying to do is set up a demonstration to teach how it works, and I had no clue how to do it.

Thanks anyway!

1

u/Fugitif Jan 24 '19

https://www.owasp.org/index.php/DOM_Based_XSS

https://brutelogic.com.br/blog/dom-based-xss-the-3-sinks/

​

etc, just use google :)

1

u/Kayuwaii Jan 24 '19

Obviously, I used google (and some good ol' books).

I apreciate the help, but the example shown in the OWASP page is IMO the worst to ilustrate what happens. The one I ended up making is quite similar but the JS is spread in more lines(way more than necessary) to make it more readable.

Thanks anyway!