Conduct XSS Vulnerability Experiments with Hackbar

Introduction

Welcome to our interactive lab! Here, we'll dive into the world of web security by focusing on Cross-Site Scripting (XSS) - a common but crucial vulnerability in web applications. If a website isn't properly protected against XSS, it can become a playground for attackers.

But don't worry! We're going to help you understand and tackle this issue. We'll start by breaking down what XSS is, why it's important, and how it can be exploited. We'll then guide you through using a tool called 'hackbar', which will assist us in identifying potential XSS vulnerabilities.

In addition, we'll also explore various 'bypassing techniques'. These are clever methods that attackers can use to circumvent security measures, and by understanding them, we can better protect our websites.

Remember, the best way to learn is by doing - so we'll be conducting hands-on experiments throughout. By the end of this lab, you'll have a solid understanding of XSS vulnerabilities and how to prevent them. Let's get started!

Skills Graph

任意の半径の円の面積

慣れ親しんだ公式 S = πr^2 を使って、ターミナルから入力された半径の円の面積を計算します。

準備

1. ~/project ディレクトリに Circle.java という名前のソースファイルを作成します。
   

2. 基本コードを用意します。以下のコードを元にチャレンジを完了してください。

   public class Circle {
       public static void main(String[] args) {
         // コード
       }
   }

要件

1. Circle.java ソースファイルを作成し、main() メソッドにロジックコードを追加します。
2. 半径 r を整数型で定義し、定数 PI を値が 3.14 の単精度浮動小数点数定数とし、面積 s を単精度浮動小数点数とします。
3. 半径はキーボードからのデータとして入力し、プロンプトメッセージは "Please enter the radius of the circle: " とします。
4. 計算後、結果を "The area of the circle is: N" として出力します。
5. コードは上記の要件に従って記述する必要があります。そうでない場合、チャレンジの成功裏の完了に影響を与える可能性があります。

例

結果を検証するには、以下の手順を参照してください。

labex:project/ $ javac Circle.java
labex:project/ $ java Circle
Please enter the radius of the circle:2
The area of the circle is:12.56

あなたが続けると、バックエンドは個別のテストケースを使用して検証を行います。上記の資料で使用されている階段の数、初期口座残高、プラットフォームの合計制限、商人の数、および入札価格はすべてテストケースです。バックエンド検証では異なるパラメータが使用され、テストケースとまったく同じにはなりません。ご注意ください！

XSS Vulnerability Experiment 1

In this segment, we'll delve into a basic XSS (Cross-Site Scripting) vulnerability, and learn how we can exploit it using hackbar.

Firstly, execute the command below to prepare our lab environment:

docker run -d -p 82:80 --name pentesterlab-WebforPentest-1 -it jewel591/vulnbox:pentesterlab-WebforPentest-1 /bin/sh -c 'service apache2 start && tail -f /var/log/apache2/error.log' --registry-mirror='https://registry.docker-cn.com'

Next, launch your web browser and navigate to this URL:

http://127.0.0.1:82/xss/example1.php?name=hacker

Here are the steps to exploit the XSS vulnerability:

1. Press F12 to Launch hackbar and click on "Load URL" to pull in the current page URL.
2. Modify the name parameter value to 123 and then click "Execute". You should observe the page updating with this new value, as depicted in the image below.
   
3. Utilize the built-in XSS payload in hackbar (XSS > XSS Alert) and click "Execute". This should result in an XSS alert being triggered, as depicted in the image below.
   

XSS Vulnerability Experiment 2

In this part, we'll explore a basic technique to bypass XSS (Cross-Site Scripting) filters.

Start by navigating to the URL below in your web browser:

http://127.0.0.1:82/xss/example2.php?name=hacker

Here are the steps to bypass the XSS filter:

1. Attempt to inject a simple XSS payload using hackbar, for instance, <script>alert(1)</script>. You'll find that this doesn't yield the expected result, as depicted in the image below.
   
2. Inspect the source code of the page. You'll notice that the <script> and </script> tags are being filtered out, as depicted in the image below.
   
3. To circumvent this filter, try using a different case for the script tag, like <ScripT>alert(1)</ScripT>. This might allow you to bypass the filter and successfully inject the XSS payload, as depicted in the image below.
   

XSS Vulnerability Experiment 3

In this phase, we will learn how to employ various HTML tags and attributes to execute XSS (Cross-Site Scripting) attacks.

First, navigate to the URL below in your web browser:

http://127.0.0.1:82/xss/example4.php?name=hacker

Follow these steps to bypass the XSS filter and execute an attack:

1. Attempt to inject a simple XSS payload using hackbar. However, you'll observe that the server identifies and blocks the script keyword, as depicted in the image below.
   
2. To circumvent this filter, we'll use the <a> HTML tag in combination with the onclick attribute:

<a onclick="alert('xss')">xss</a>

This payload generates a clickable link on the webpage. When clicked, it triggers the alert('xss') JavaScript function.

3. Click on the "xss" link on the page. You should see the XSS alert being activated, as depicted in the image below.
   

There's a multitude of HTML tags and attributes that can be used in tandem to launch XSS attacks. For more sophisticated XSS payloads, refer to the following repository:

https://github.com/iSecurity-Club/Pentest-Methodologies/blob/master/web-exploit-exp/xss/payloads.txt

Summary

In this lab, we learned the fundamental techniques for discovering and exploiting XSS vulnerabilities. We explored how to use the hackbar tool to test for XSS vulnerabilities and employed various bypassing techniques, such as case manipulation and using different HTML tags and attributes. Through hands-on experiments, we gained practical experience in identifying and exploiting XSS vulnerabilities in web applications. This lab provided a solid foundation for further exploration of more advanced XSS techniques and web application security testing.