[Niely]

Hello

I have to make a report about a XSS-vulnerability for a (serious) website.
But how do I show them that non-persistent XSS is dangerous?

I already have cookie-stealing, and phising, but how can XSS (non-persistent) also be dangerous on other ways?

How do I show them it is dangerous? (Small codes)

Thanks for reading,
Niely

[Jon Snow]

You can't. All you can do is steal the cookie or redirect them to another page.

[Niely]

^Isn't it possible to do load a PHP code which is stored on another website, with JavaScript?

[How bout using your brain]

What do you mean with load a php code? If sending a request to a php script, then yes it is possible, but what is the point of it? It's basically similar to a redirect.

You can use XSS to steal cookies, make http requests as the victim, phish, make people download some shit, etc.

[Niely]

What do you mean with load a php code? If sending a request to a php script, then yes it is possible, but what is the point of it? It's basically similar to a redirect.

You can use XSS to steal cookies, make http requests as the victim, phish, make people download some shit, etc.

How'd I load a PHP script from my own website to the vulnerable website?
If this code is on my website:

Code

<?php
echo "<script>alert(1)</script>;";
?>

How do I launch that on that vulnerable website?

[Pillows]

How'd I load a PHP script from my own website to the vulnerable website?
If this code is on my website:

Code

<?php
echo "<script>alert(1)</script>;";
?>

How do I launch that on that vulnerable website?

For the last part, you can't. What you can do is redirect people to a dangerous website through the XSS.

[Soulo]

If the website has any sort of admin panel/CMS which allows for RCE (via theme editing, arbitrary file upload, etc), then it is completely possible to leverage a XSS attack to RCE in a matter seconds by using an admin's session to send arbitrary requests.

See the following:

[Niely]

^Thanks for the interesting video mate! :)
But I don't think there is a CMS in use.

[Nitai]

You can't, PHP using the server, XSS using the client .

[๖ۣۜCriminal]

lookup facebook xss PoC a guy made a javascript file to update someones facebook email and steal the chat logs using a basic xss payload so basically anything that javascripts capable which is alot can be used against someone including scraping chat logs and stuff like that(basically sending http requests as the victim like sirootalot said).

[Pιɴĸ]

^Isn't it possible to do load a PHP code which is stored on another website, with JavaScript?

No you can not it is not the whole source code since you the have there php db.

[cheatson]

Meh. Nobody gives a shit about reflective XSS unless they have an established bounty program or you get lucky. If you have to explain why it is dangerous, the odds of getting anything out of it are slim to none is my feeling [Hidden exploit pack attacks; privilege escalation with session surfing and or in conjunction with CSRF/other complementary vulns]

[ShadowCloud]

The best example I can think of is loading up some js via an external location. The most obvious use for some js like this would be to manipulate the login form...

You simply change the form's action from /somefolder/login.php to evilhost.com/myfolder/mylogger.php. When the user submits this form you record his login details then make a POST request from mylogger.php back to somefolder.login.php so the user will legitimately see a "Incorrect username or password" message, when they try again (assuming finger trouble) they'll be logged in and be none the wiser.

[Frosteh]

The worst security implications of XSS are stealing the cookies of a user and being able to make requests to the server as their identity, in the case of an admin panel or CMS being used that might allow you to gain access to an admin panel you wouldn't otherwise be able to access.

You cannot load remote PHP code onto a site with XSS, PHP is run on the web server before the page is rendered and javascript is run in the clients browser after the page has rendered.

In your example you're trying to load remote PHP which only contains javascript, you can in fact load remote javascript through XSS, simply link a script tag to your hosted script, something like:

<script src="mywebsite.js"></script>

You can use XSS as part of larger attacks however, social engineering and things like that, getting admin credentials using XSS requires you to get a user with an admin account to follow your link and your script to reflect their cookies back to you, then you get into the CMS and possibly upload a shell or make your own admin account, etc.

XSS is more of a risk to user data and phishing than a direct threat to the security of the server itself.

---

Meh. Nobody gives a shit about reflective XSS unless they have an established bounty program or you get lucky. If you have to explain why it is dangerous, the odds of getting anything out of it are slim to none is my feeling [Hidden exploit pack attacks; privilege escalation with session surfing and or in conjunction with CSRF/other complementary vulns]

I dunno about that, if you have any kind login system where some users have elevated privileges such admin/mod/author, then you can do a good social engineering attack with reflected XSS by sending them a link to follow, grabbing their credentials/cookies and elevating your own privs.

For example

Dear support team, I was browsing your website the other day and all the images stopped working, this link doesn't work in firefox or chrome

http://www.mywebsite.com/index.php?id=%3...9%70%74%3E

That link is going to get passed back probably to at least a CMS mod/author, and then maybe an admin/developer and god knows how many newbs in between.

Sometimes they'll be savvy enough to URL decode the link first, then browse the remote script first before using the link, most of the time not, that's a good attack vector any security team ought to be wary of.

[Niely]

Okay, thanks all!
Got some ideas from here. :)

If someone still know other things, feel free to post!
The smallest things can help me out.