Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

XSS Reflected and XXE Vulnerability Changes #432

Open
wants to merge 7 commits into
base: master
Choose a base branch
from
Open

XSS Reflected and XXE Vulnerability Changes #432

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
36c0a0a
Add files via upload
Prince-1110 Feb 4, 2023
74db5fc
XSS reflected validation update
Prince-1110 Feb 4, 2023
8a1b964
Delete reflected directory
Prince-1110 Feb 4, 2023
0c3850a
Add files via upload
Prince-1110 Feb 5, 2023
75a88b8
Add files via upload
Prince-1110 Feb 5, 2023
719d2d7
XSS Reflected and XXE Changes
Prince-1110 Feb 15, 2023
e3ef791
XSS Reflected and XXE message addition
Prince-1110 Feb 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 59 additions & 0 deletions src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,4 +201,63 @@ public ResponseEntity<String> getVulnerablePayloadLevelSecure(
return new ResponseEntity<>(HttpStatus.BAD_REQUEST);
}
}

// Escape all the input which provides eval expression in a payload
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the below method is also escaping other things apart from eval. isn't it?

// and validate input.
@AttackVector(
vulnerabilityExposed = VulnerabilityType.REFLECTED_XSS,
description = "XSS_QUOTES_AND_WITH_HTML_ESCAPE_PLUS_FILTERING_EVAL_EXPRESSION_ON_INPUT_SRC_ATTRIBUTE_IMG_TAG")
@VulnerableAppRequestMapping(value = LevelConstants.LEVEL_8, htmlTemplate = "LEVEL_1/XSS")
public ResponseEntity<String> getVulnerablePayloadLevel8(
@RequestParam(PARAMETER_NAME) String imageLocation) {

String vulnerablePayloadWithPlaceHolder = "<img src=%s width=\"400\" height=\"300\"/>";

String payload =
String.format(
vulnerablePayloadWithPlaceHolder,
StringEscapeUtils.escapeHtml4(imageLocation));

return new ResponseEntity<>(payload, HttpStatus.OK);
}

// Escape all paranoid characters to their corresponding HTML tag
// and validate input.
@AttackVector(
vulnerabilityExposed = VulnerabilityType.REFLECTED_XSS,
description =
"XSS_HTML_ESCAPE_ON_DIRECT_INPUT_AND_REMOVAL_OF_PARANOID_VALUES_WITH_SRC_ATTRIBUTE_IMG_TAG")
@VulnerableAppRequestMapping(value = LevelConstants.LEVEL_9, htmlTemplate = "LEVEL_1/XSS")
public ResponseEntity<String> getVulnerablePayloadLevel9(
@RequestParam(PARAMETER_NAME) String imageLocation) {

String vulnerablePayloadWithPlaceHolder = "<img src=%s width=\"400\" height=\"300\"/>";

String payload =
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what is the difference between level 8 and level 9?

String.format(
vulnerablePayloadWithPlaceHolder,
StringEscapeUtils.escapeHtml4(imageLocation));

return new ResponseEntity<>(payload, HttpStatus.OK);
}

// Checking for onload function which is passing into the html tag
// and validate input.'
@AttackVector(
vulnerabilityExposed = VulnerabilityType.REFLECTED_XSS,
description =
"XSS_HTML_ESCAPE_ON_DIRECT_INPUT_AND_REMOVAL_OF_ONLOAD_FUNCTIONS_WITH_PARENTHESIS_SRC_ATTRIBUTE_IMG_TAG")
@VulnerableAppRequestMapping(value = LevelConstants.LEVEL_10, htmlTemplate = "LEVEL_1/XSS")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this one is also same as level 9. am i missing something?

public ResponseEntity<String> getVulnerablePayloadLevel10(
@RequestParam(PARAMETER_NAME) String imageLocation) {

String vulnerablePayloadWithPlaceHolder = "<img src=%s width=\"400\" height=\"300\"/>";

String payload =
String.format(
vulnerablePayloadWithPlaceHolder,
StringEscapeUtils.escapeHtml4(imageLocation));

return new ResponseEntity<>(payload, HttpStatus.OK);
}
}
66 changes: 66 additions & 0 deletions src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSWithHtmlTagInjection.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,4 +85,70 @@ public ResponseEntity<String> getVulnerablePayloadLevel3(
}
return new ResponseEntity<String>(payload.toString(), HttpStatus.OK);
}

// Just adding User defined input(Untrusted Data) into div tag if doesn't contains
// eval(...) expression which evaluates the string expression and returns its value.
// Can be broken by various ways

@AttackVector(
vulnerabilityExposed = VulnerabilityType.REFLECTED_XSS,
description = "XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_EVAL_EXPRESSION")
@VulnerableAppRequestMapping(value = LevelConstants.LEVEL_8, htmlTemplate = "LEVEL_1/XSS")
public ResponseEntity<String> getVulnerablePayloadLevel8(
@RequestParam Map<String, String> queryParams) {
String vulnerablePayloadWithPlaceHolder = "<div>%s<div>";
StringBuilder payload = new StringBuilder();
Pattern pattern = Pattern.compile("eval\\((.*?)\\)");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you please add an extra blacklist defence to level 3 here?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or make it as level 2 as first level has not defence and level 2 has eval based defence and then move other levels to next levels like level3 becomes level 4 and so on.

for (Map.Entry<String, String> map : queryParams.entrySet()) {
Matcher matcher = pattern.matcher(map.getValue());
if (!matcher.find()) {
payload.append(String.format(vulnerablePayloadWithPlaceHolder, map.getValue()));
}
}
return new ResponseEntity<String>(payload.toString(), HttpStatus.OK);
}

// Just adding User defined input(Untrusted Data) into div tag if doesn't contains
// Paranoid regex.
// Can be broken by various ways

@AttackVector(
vulnerabilityExposed = VulnerabilityType.REFLECTED_XSS,
description = "XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_PARANOID")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

better to add more description than just paranoid values.

@VulnerableAppRequestMapping(value = LevelConstants.LEVEL_9, htmlTemplate = "LEVEL_1/XSS")
public ResponseEntity<String> getVulnerablePayloadLevel9(
@RequestParam Map<String, String> queryParams) {
String vulnerablePayloadWithPlaceHolder = "<div>%s<div>";
StringBuilder payload = new StringBuilder();
Pattern pattern = Pattern.compile("<script(.*?)[\r\n]*(.*?)/script>");
for (Map.Entry<String, String> map : queryParams.entrySet()) {
Matcher matcher = pattern.matcher(map.getValue());
if (!matcher.find()) {
payload.append(String.format(vulnerablePayloadWithPlaceHolder, map.getValue()));
}
}
return new ResponseEntity<String>(payload.toString(), HttpStatus.OK);
}

// Just adding User defined input(Untrusted Data) into div tag if contains
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please add the possible payloads to break the levels.

// onLoad expression which deals with the cookies.
// Can be broken by various ways
@AttackVector(
vulnerabilityExposed = VulnerabilityType.REFLECTED_XSS,
description =
"XSS_DIRECT_INPUT_DIV_TAG_AFTER_REMOVING_VALUES_CONTAINING_ONLOAD_EXPRESSION")
@VulnerableAppRequestMapping(value = LevelConstants.LEVEL_10, htmlTemplate = "LEVEL_1/XSS")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so we can reformat, level 8 method which you created can be called level 2, level 9 can be called level 3, level 10 can be called level 4 and then currently level 2 and level 3 can be called level 5 and level 6 respectively.

public ResponseEntity<String> getVulnerablePayloadLevel10(
@RequestParam Map<String, String> queryParams) {
String vulnerablePayloadWithPlaceHolder = "<div>%s<div>";
StringBuilder payload = new StringBuilder();
Pattern pattern = Pattern.compile("onload(.*?)=");
for (Map.Entry<String, String> map : queryParams.entrySet()) {
Matcher matcher = pattern.matcher(map.getValue());
if (!matcher.find()) {
payload.append(String.format(vulnerablePayloadWithPlaceHolder, map.getValue()));
}
}
return new ResponseEntity<String>(payload.toString(), HttpStatus.OK);
}
}
Loading