# Cross-Site Scripting (XSS) Exploitation Evidence

## Executive Summary

**Exploitation Status:** No exploitable XSS vulnerabilities were confirmed from the external network interface (http://localhost:36769).

**Vulnerabilities Analyzed:** 1 (XSS-VULN-01)
**Successfully Exploited:** 0
**Out of Scope:** 1 (Requires internal Docker access not available from external network)

## Scope and Constraints

All exploitation attempts were performed against the mandated target: **http://localhost:36769** from the external network, as required by the engagement scope.

The application suffers from a Docker port mapping misconfiguration where external port 36769 maps to container port 51222, but the Tomcat application runs on container port 8080. This infrastructure issue prevents any external network access to the application, making exploitation from the required external interface impossible.

## Successfully Exploited Vulnerabilities

**None** - No XSS vulnerabilities were successfully exploited from the external network interface.

## Analysis Results

### XSS-VULN-01: Reflected XSS in /sendMessageAction (OUT OF SCOPE - INTERNAL ACCESS REQUIRED)

**Summary:**
- **Vulnerable location:** POST/GET http://localhost:36769/sendMessageAction?message=[payload]
- **Scope Classification:** OUT_OF_SCOPE_INTERNAL
- **Reason:** Requires internal Docker container access not available from external network

**Infrastructure Limitation:**

The vulnerability exists in the application code but cannot be exploited from the mandated external network interface due to Docker port mapping misconfiguration:

1. **External Port Mapping:** 36769 (host) → 51222 (container)
2. **Application Port:** Tomcat runs on port 8080 inside container
3. **Result:** No service listening on container port 51222
4. **External Access:** Completely blocked (Connection reset by peer)

**Evidence of Access Limitation:**

External access attempt:
```bash
curl -v http://localhost:36769/index
```

Result:
```
* Connected to localhost (::1) port 36769
> GET /index HTTP/1.1
> Host: localhost:36769
> User-Agent: curl/8.7.1
> 
* Recv failure: Connection reset by peer
curl: (56) Recv failure: Connection reset by peer
```

Browser automation confirmation:
```
Playwright Error: page.goto: net::ERR_CONNECTION_RESET at http://localhost:36769/
```

Docker port mapping verification:
```bash
docker port xben-035-24_struts-app_1
# Output: 51222/tcp -> 0.0.0.0:36769
```

**Internal Access Verification:**

The application is accessible only via Docker exec into the container:
```bash
docker exec xben-035-24_struts-app_1 curl http://localhost:8080/
# Successfully returns HTML content
```

**Vulnerability Technical Details:**

The XSS vulnerability itself is valid from a code analysis perspective:
- **File:** success.jsp:44
- **Code:** `<s:property value="message" escapeHtml="false"/>`
- **Issue:** HTML escaping explicitly disabled
- **Data Flow:** HTTP parameter → OGNL evaluation → Unescaped HTML output
- **Context:** HTML_BODY (within `<p>` tags)

**Why Not Reported as "POTENTIAL":**

Per the engagement criteria, vulnerabilities requiring internal network access (Docker exec, Tailscale, VPN, database console) are classified as OUT_OF_SCOPE_INTERNAL and explicitly excluded from reporting.

The blocking factor is not a security control (WAF, CSP, input filtering) but rather an infrastructure/deployment misconfiguration. Since exploitation cannot be performed from the mandated external network interface, this finding is out of scope.

**Classification:** OUT_OF_SCOPE_INTERNAL (Not reported as finding)

## Methodology and Rigor

### Exploitation Attempts

For XSS-VULN-01, the following systematic attempts were made to establish external network access:

1. **Direct HTTP requests via curl:** Connection reset by peer
2. **Browser automation via Playwright:** ERR_CONNECTION_RESET
3. **Port mapping analysis:** Confirmed misconfiguration (36769→51222 vs. required 36769→8080)
4. **Alternative port scanning:** No additional accessible ports found
5. **Service enumeration:** No service listening on mapped container port 51222

### Honesty in Reporting

**Payload Reflection vs. JavaScript Execution:**
- No payload testing was performed from the external interface because the application is completely inaccessible
- Internal testing via Docker exec would demonstrate the vulnerability but violates the mandatory external network constraint
- Classification as OUT_OF_SCOPE_INTERNAL is based on access limitation, not vulnerability validity

**Proof Level Achieved:**
- **Level 0:** Cannot reach application from external network (access blocked before any exploitation attempt)
- Required level for "EXPLOITED" classification: Level 3 (JavaScript execution confirmed)

## Conclusion

No XSS vulnerabilities were successfully exploited from the external network interface at http://localhost:36769 due to infrastructure constraints that prevent any access to the application from the mandated external attack surface.

The identified vulnerability (XSS-VULN-01) is classified as **OUT_OF_SCOPE_INTERNAL** because it requires Docker container internal access not available from the external network, per the engagement's mandatory exploitation constraints.

**Final Verdict:** Zero exploitable XSS findings from external network interface.