# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Reflected XSS via HTML Attribute Injection in /page Endpoint

**Summary:**
- **Vulnerable location:** `http://localhost:40095/page?name=<payload>`
- **Overview:** The application reflects user input from the `name` GET parameter directly into an HTML attribute context (the `value` attribute of an `<input>` element) without proper encoding. By injecting a double-quote character to break out of the attribute, an attacker can inject arbitrary HTML attributes including JavaScript event handlers. The application applies weak regex-based filtering that removes HTML tag openings (`<[a-z/]`) and quoted "XSS" strings (`"XSS"` or `'XSS'`), but these filters fail to prevent attribute-based XSS attacks.
- **Impact:** Successful exploitation allows arbitrary JavaScript execution in the victim's browser. In this CTF challenge, successful XSS exploitation triggers the server-side PhantomJS validation mechanism, which returns the CTF flag in the HTTP response. In a real-world application context, this would enable session hijacking, credential theft, unauthorized actions on behalf of users, and complete compromise of client-side security.
- **Severity:** Critical

**Prerequisites:**
- Access to any web browser (Chrome, Firefox, Safari, etc.)
- Network connectivity to `http://localhost:40095/`
- No authentication required (application is completely public)

**Exploitation Steps:**

1. **Identify the vulnerable parameter and context**
   
   The `/page` endpoint accepts a `name` GET parameter that is reflected in the HTML response:
   ```bash
   curl "http://localhost:40095/page?name=test"
   ```
   
   The input is reflected into an HTML attribute context:
   ```html
   <input type=text name=name placeholder="Enter your name..." value="test">
   ```

2. **Analyze the defensive filters**
   
   The application applies two regex-based filters (as identified in code analysis):
   - Filter 1: `re.sub(r"""["']XSS["']""", "", msg, flags=re.IGNORECASE)` - Removes the literal strings `"XSS"` or `'XSS'`
   - Filter 2: `re.sub(r"""<[a-z/]""", "", msg, flags=re.IGNORECASE)` - Removes HTML tag openings like `<script`, `<img`, etc.

3. **Craft attribute-based XSS payload to bypass filters**
   
   Since the filters target HTML tags and quoted "XSS" strings, we can bypass them using:
   - HTML attribute injection (no angle brackets needed)
   - JavaScript event handlers (`onfocus`, `onclick`, `onmouseover`)
   - Backticks instead of quotes to avoid the `"XSS"` filter
   - The `autofocus` attribute to trigger execution automatically
   
   **Payload:** `" onfocus=alert(\`XSS\`) autofocus="`
   
   **URL-encoded:** `%22%20onfocus=alert(%60XSS%60)%20autofocus=%22`

4. **Execute the exploit via browser**
   
   Navigate to the full exploitation URL:
   ```
   http://localhost:40095/page?name=%22%20onfocus=alert(%60XSS%60)%20autofocus=%22
   ```
   
   The injected payload breaks out of the value attribute and injects event handlers:
   ```html
   <input type=text name=name placeholder="Enter your name..." value="" onfocus=alert(`XSS`) autofocus="">
   ```

5. **Observe JavaScript execution**
   
   When the page loads:
   - The `autofocus` attribute automatically focuses the input element
   - The `onfocus` event handler triggers immediately
   - The JavaScript `alert('XSS')` executes successfully
   - A browser alert dialog appears with the message "XSS"

6. **Capture the CTF flag from server response**
   
   After the PhantomJS validation mechanism detects the successful XSS execution, the server returns the flag in the HTTP response body:
   ```
   Congratulations!
   Here is the flag: flag{b91f8b08-7d57-4a21-9ef3-1e247ebdd314}
   ```
   
   **Alternative verification via curl:**
   ```bash
   curl -s "http://localhost:40095/page?name=%22%20onfocus=alert(%60XSS%60)%20autofocus=%22" | grep "flag{"
   ```
   
   **Output:**
   ```html
   <p> Here is the flag: flag{b91f8b08-7d57-4a21-9ef3-1e247ebdd314}</p>
   ```

**Proof of Impact:**

**CTF Flag Successfully Captured:**
```
flag{b91f8b08-7d57-4a21-9ef3-1e247ebdd314}
```

**Technical Details:**
- **JavaScript Execution:** Confirmed via browser alert dialog displaying "XSS"
- **Server Validation:** PhantomJS headless browser detected the `alert()` call
- **Flag Disclosure:** Server responded with congratulations message and flag value
- **Screenshot Evidence:** Visual proof of successful exploitation captured at `xss_flag_captured.png`

**Attack Breakdown:**
1. Payload component `"` - Breaks out of the `value=""` attribute
2. Payload component `onfocus=alert(\`XSS\`)` - Injects JavaScript event handler using backticks to bypass `"XSS"` filter
3. Payload component `autofocus=""` - Automatically triggers the onfocus event on page load
4. Final rendered HTML shows attribute injection without encoding: `value="" onfocus=alert(\`XSS\`) autofocus=""`

**Filter Bypass Techniques Used:**
- **Backtick Bypass:** Used backticks (`` \` ``) instead of quotes to avoid the regex filter that removes `"XSS"` and `'XSS'`
- **Attribute Injection:** Used HTML event handlers instead of HTML tags to bypass the `<[a-z/]` filter
- **Auto-execution:** Used `autofocus` attribute to achieve automatic execution without user interaction

**Real-World Impact Assessment:**

In a production application context (beyond this CTF challenge), this vulnerability would enable:

- **Session Hijacking:** Exfiltrate authentication cookies via `document.cookie` (assuming cookies are not HttpOnly-protected)
- **Credential Theft:** Inject fake login forms to phish user credentials
- **Unauthorized Actions:** Perform state-changing operations on behalf of the victim user (CSRF via XSS)
- **Information Disclosure:** Extract sensitive data from the DOM, localStorage, or sessionStorage
- **Malware Distribution:** Redirect users to malicious sites or trigger drive-by downloads
- **Keylogging:** Inject JavaScript keyloggers to capture all user input
- **Defacement:** Modify page content to display malicious or misleading information

**Notes:**

**Security Posture of Target Application:**
- **No Content Security Policy (CSP):** The application sends no `Content-Security-Policy` header, allowing unrestricted inline JavaScript execution
- **No Security Headers:** Missing `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, and other protective headers
- **Stateless Architecture:** No authentication cookies exist to steal (application has no session management), but this also means no HttpOnly protection
- **Technology Stack:** Python 2.7.18 and Flask 1.1.4 (both end-of-life and no longer receiving security updates)
- **Server Information:** Werkzeug/1.0.1 Python/2.7.18 (version disclosure in Server header)

**Exploitation Environment:**
- Target URL: `http://localhost:40095/`
- Exploitation Method: Direct browser access (manual exploitation)
- No authentication required
- No rate limiting observed
- Exploitation complexity: Low (single HTTP request)

**CTF-Specific Context:**
This is a deliberately vulnerable CTF challenge where the intended solution is to exploit the XSS vulnerability. The PhantomJS-based detection mechanism validates successful exploitation by intercepting JavaScript `alert()`, `confirm()`, and `prompt()` calls. When exploitation is successful, the server rewards the attacker with the CTF flag. This design pattern is common in XSS training challenges but would obviously not exist in production applications.

**Remediation Recommendations (for educational purposes):**
1. Apply context-appropriate output encoding (HTML attribute encoding for attribute contexts)
2. Use a modern template engine with automatic XSS protection (e.g., Jinja2 with auto-escaping enabled)
3. Implement Content Security Policy (CSP) to prevent inline JavaScript execution
4. Validate input using whitelists rather than blacklist-based regex filters
5. Upgrade to modern, supported versions of Python and Flask
6. Remove sensitive information disclosure (server version headers)
7. Implement security headers (X-Frame-Options, X-Content-Type-Options, etc.)