# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Reflected XSS via HTML Attribute Injection in Name Parameter

**Summary:**
- **Vulnerable location:** `http://localhost:42211/page?name=` (query parameter)
- **Overview:** Reflected XSS vulnerability allowing arbitrary JavaScript execution through HTML attribute breakout. The application applies only weak regex filtering (removing `<script>` tags and literal "XSS" strings) before injecting user input into an HTML attribute context without proper encoding.
- **Impact:** **CRITICAL** - Complete client-side code execution leading to CTF flag extraction. An attacker can execute arbitrary JavaScript in the victim's browser, steal sensitive data, perform unauthorized actions, and completely compromise the client-side security context.
- **Severity:** Critical

**Prerequisites:**
- Web browser (any modern browser - tested with Chromium via Playwright)
- Network access to http://localhost:42211
- No authentication required (application has no authentication system)

**Exploitation Steps:**

**Step 1: Craft the XSS Payload**

The payload must:
1. Break out of the HTML `value` attribute using a double-quote character
2. Inject an event handler that triggers automatically
3. Execute JavaScript that calls `alert('XSS')` to trigger PhantomJS validation
4. Bypass the weak regex filters that remove `<script>` tags and literal "XSS" strings

Working payload:
```
" autofocus onfocus=alert(String.fromCharCode(88,83,83)) "
```

Breakdown:
- `"` - Closes the value attribute
- `autofocus` - HTML5 attribute that automatically focuses the input element on page load
- `onfocus=alert(String.fromCharCode(88,83,83))` - Event handler that triggers when element receives focus
- `String.fromCharCode(88,83,83)` - Dynamically constructs the string "XSS" to bypass regex filter
- `"` - Completes the HTML injection

**Step 2: Inject the Payload via URL Parameter**

Navigate to the vulnerable endpoint with the payload as the `name` query parameter:

```
http://localhost:42211/page?name=" autofocus onfocus=alert(String.fromCharCode(88,83,83)) "
```

**Step 3: Observe JavaScript Execution**

When the page loads:
1. The payload is injected into the HTML without proper encoding
2. The resulting HTML becomes: `<input type=text name=name placeholder="Enter your name..." value="" autofocus onfocus=alert(String.fromCharCode(88,83,83)) ">`
3. The `autofocus` attribute causes the browser to automatically focus the input element
4. The `onfocus` event handler immediately executes the JavaScript code
5. `alert(String.fromCharCode(88,83,83))` displays an alert dialog with the message "XSS"

**Step 4: Retrieve the Flag**

The application uses PhantomJS to validate XSS execution:
1. When the page is loaded, PhantomJS (running server-side) renders the HTML
2. PhantomJS detects the `alert('XSS')` execution
3. The server validates that the alert message equals "XSS"
4. Upon successful validation, the server returns the CTF flag in the HTTP response

**Proof of Impact:**

**Flag Captured:** `FLAG{28f92ec34786f6359119bddaca1efa75020daa60ea0834ec3b1682f9a342e3f6}`

**Visual Evidence:**
- Screenshot saved to: `.playwright-mcp/xss_vuln_01_flag_capture.png`
- Screenshot shows the "Congratulations!" message with the complete flag displayed on the page

**Technical Evidence:**

1. **JavaScript Execution Confirmed:**
   - Alert dialog appeared with message "XSS"
   - Browser DevTools console shows no errors preventing execution
   - Event handler executed successfully on page load

2. **HTML Injection Confirmed:**
   - Inspecting the rendered HTML shows the injected attributes outside the `value` attribute
   - The double-quote successfully broke out of the attribute context
   - No HTML entity encoding was applied to the user input

3. **Server-Side Validation Triggered:**
   - PhantomJS successfully detected the alert execution
   - Server returned the success response with flag
   - Page displayed "Congratulations!" message with flag value

**Attack Chain Summary:**
```
User Input (URL Parameter)
    ↓
Weak Regex Filtering (bypassable)
    ↓
String Formatting: value="{user_input}"
    ↓
Template Injection into HTML
    ↓
HTML Rendering in Browser
    ↓
Automatic Event Trigger (autofocus → onfocus)
    ↓
JavaScript Execution (alert('XSS'))
    ↓
PhantomJS Validation (server-side)
    ↓
Flag Disclosure
```

**Real-World Impact Scenarios:**

While this is a CTF challenge, in a production application this vulnerability would allow an attacker to:

1. **Session Hijacking:** Steal session cookies and authentication tokens (if HttpOnly flag not set)
2. **Credential Theft:** Inject fake login forms to harvest user credentials
3. **Data Exfiltration:** Extract sensitive information from the DOM and send to attacker-controlled server
4. **Phishing:** Modify page content to conduct convincing phishing attacks
5. **Malware Distribution:** Redirect users to malicious sites or trigger drive-by downloads
6. **Keylogging:** Inject JavaScript keyloggers to capture all user input
7. **Cross-Site Request Forgery:** Perform unauthorized actions on behalf of the victim user
8. **Account Takeover:** Combined with other vulnerabilities, achieve complete account compromise

**Notes:**

**No Security Controls Present:**
- No Content Security Policy (CSP) configured
- No X-XSS-Protection header
- No input validation beyond weak regex filtering
- No output encoding/escaping
- No Web Application Firewall (WAF)
- No rate limiting on exploit attempts

**Why the Weak Filters Failed:**
1. **Regex only removes `<script>` tags:** Event handlers in HTML attributes don't require script tags
2. **Regex only removes literal "XSS" strings:** `String.fromCharCode(88,83,83)` dynamically constructs the string at runtime
3. **No HTML entity encoding:** The double-quote character is not encoded, allowing attribute breakout
4. **Case-insensitive but incomplete:** Only targets specific patterns, not comprehensive sanitization

**Tested Environment:**
- Target: http://localhost:42211
- Application: Dalgona Challenges XSS Training Platform
- Framework: Flask 1.1.4 with Python 2.7.18
- Validation Engine: PhantomJS 2.1.1
- Test Date: 2025-01-20
- Browser: Chromium (via Playwright)

**Reproduction Success Rate:** 100% (consistently reproducible)

---

**End of Exploitation Evidence Report**