Hello. In this (very) brief thread I'm going to explain the following term: XSS Morphing, and one technique of performing it.
Our target:
![[Image: 5fd4793769cd9cd19a765bbb1055e368.png]](https://i.gyazo.com/5fd4793769cd9cd19a765bbb1055e368.png)
URL: http://hsld-clan.com/XSSMorph/index.php
XSS Morphing:
Is the term used to change one type of XSS into another by several common, less common, or completely private tricks. From Self-XSS to DoM XSS, to Reflected XSS to maybe even Stored XSS, it's all possible one way or another. If I'll care enough I'll reveal one of my actual half interesting ones. This is kindergarten level ;^)
We're going to attempt a basic XSS attack pattern. First, we'll view the source code:
Alright, so, it appears our target input works through POST. It is a shame as we can't link a POST based request to our target in hopes he'll click on it and give us his delicious, moist cookies. However, we have come this far and we're not ready to give up yet.
Lets attempt an attack Proof Of Concept:
![[Image: 957b35ff17a933cd7569e2cd560d8ef8.png]](https://i.gyazo.com/957b35ff17a933cd7569e2cd560d8ef8.png)
It works. What now?
It's simple, we take the parameter and shove it as a GET one.
Like this:![[Image: 52c0583b42f00b079868627bef6008ec.png]](https://i.gyazo.com/52c0583b42f00b079868627bef6008ec.png)
Wait, Sonder, How the fuck did it happen? Our form is clearly POST oriented, meaning it only accepts POST method-based input and displays it rendering XSS as useless!
No, my sweet summer child. You see, our silly pony programmer used the $_REQUEST methodology instead of $_POST.
Details: http://php.net/manual/en/reserved.variables.request.php
Basically, $_REQUEST is a superglobal PHP array (Just like $_GET and $_POST), but it includes both of them and $_COOKIE as well, making whatever you're doing in HTML pointless when your PHP serverside script accepts all input no matter it's method. I would honestly suggest not to use $_REQUEST at all price because of that one rare case when you forget to filter the output of the registered username, but it's not that dangerous because of the POST request done, right? Yeah, if you're using $_REQUEST you're screwed.
The ways to handle against this are simple:
1) Learn to filter variables. This is shown at my White-Hat tutorial, look it up.
2) Remember our "go" named submit button? It's also working through $_REQUEST. What if we forced it to use $_POST? Then the XSS will go to shit and won't work as you can only verify the form being sent through POST.
The source code of my page, for future reference:
Note: This tutorial's writer is participating in The Sonder Challenge, forcing him to write a silly tutorial per day until he runs out of ideas. This is my first tutorial in the challenge. New one tomorrow. Challenge link: https://hackforums.net/showthread.php?tid=4395018
I'm out.
Our target:
URL: http://hsld-clan.com/XSSMorph/index.php
XSS Morphing:
Is the term used to change one type of XSS into another by several common, less common, or completely private tricks. From Self-XSS to DoM XSS, to Reflected XSS to maybe even Stored XSS, it's all possible one way or another. If I'll care enough I'll reveal one of my actual half interesting ones. This is kindergarten level ;^)
We're going to attempt a basic XSS attack pattern. First, we'll view the source code:
Code
<html>
<head>
<title>xss</title>
</head>
<body>
<form action="" method="post">
Write something:<input type="text" name="input">
<input type="submit" name="go">
</form>
</body>
</html>Lets attempt an attack Proof Of Concept:
It works. What now?
It's simple, we take the parameter and shove it as a GET one.
Like this:
Code
http://hsld-clan.com/XSSMorph/index.php?input=a&go=Submit+QueryWait, Sonder, How the fuck did it happen? Our form is clearly POST oriented, meaning it only accepts POST method-based input and displays it rendering XSS as useless!
No, my sweet summer child. You see, our silly pony programmer used the $_REQUEST methodology instead of $_POST.
Details: http://php.net/manual/en/reserved.variables.request.php
Basically, $_REQUEST is a superglobal PHP array (Just like $_GET and $_POST), but it includes both of them and $_COOKIE as well, making whatever you're doing in HTML pointless when your PHP serverside script accepts all input no matter it's method. I would honestly suggest not to use $_REQUEST at all price because of that one rare case when you forget to filter the output of the registered username, but it's not that dangerous because of the POST request done, right? Yeah, if you're using $_REQUEST you're screwed.
The ways to handle against this are simple:
1) Learn to filter variables. This is shown at my White-Hat tutorial, look it up.
2) Remember our "go" named submit button? It's also working through $_REQUEST. What if we forced it to use $_POST? Then the XSS will go to shit and won't work as you can only verify the form being sent through POST.
The source code of my page, for future reference:
PHP Code
<?php
<html>
<head>
<title>xss</title>
</head>
<body>
<form action="" method="post">
Write something:<input type="text" name="input">
<input type="submit" name="go">
</form>
</body>
</html>
<?php
$input = $_REQUEST['input'];
if(isset($_REQUEST['go'])) {
echo $input;
}
?>Note: This tutorial's writer is participating in The Sonder Challenge, forcing him to write a silly tutorial per day until he runs out of ideas. This is my first tutorial in the challenge. New one tomorrow. Challenge link: https://hackforums.net/showthread.php?tid=4395018
I'm out.
![[Image: vGscZ.gif]](https://i.imgur.com/vGscZ.gif)