Practical stored XSS Example using Burp Suite - Revision history

RHaidl at 11:24, 8 January 2023

2023-01-08T11:24:31Z

← Older revision		Revision as of 11:24, 8 January 2023
Line 32:		Line 32:
	=== Step 3 ===		=== Step 3 ===
	As the interceptor is turned on, all requests from the client to the server are intercepted.		As the interceptor is turned on, all requests from the client to the server are intercepted.
	All requests need to be forwarded, til the website loaded completely. (Click on '''Forward''')		All requests need to be forwarded, til the website has loaded completely. (Click on '''Forward''')
	[[File:stored_xss_step2.png\|600px\|intercepted request]]		[[File:stored_xss_step2.png\|600px\|intercepted request]]

Line 38:		Line 38:
	=== Step 4 ===		=== Step 4 ===
	Once the website has loaded, fill out the form with data and submit it.		Once the website has loaded, fill out the form with data and submit it.
	Now you can see, that the client sends a POST request to the backend with the content of the form in JSON.		Now you can see, that the client sends a POST request to the backend with the content of the form in JSON format.

	[[File:stored_xss_step3.png\|600px\|intercepted POST request]]		[[File:stored_xss_step3.png\|600px\|intercepted POST request]]

	=== Step 5 ===		=== Step 5 ===
	~~Change the sent JSON data of the POST request. (use a parameter, which is displayed in the frontend e.g. 'description')~~		As the transmitted data in the POST request is '''not validated on server side''', you can change a parameter of the JSON to arbitrary JavaScript code.
	As the transmitted data in the POST request is not validated on server side, you can change a parameter of the JSON to arbitrary JavaScript code.

	In this tutorial we change the 'description' parameter to the following JavaScript code		In this tutorial we change the ''''description'''' parameter to the following JavaScript code

	<code><script>alert('XSS Code Injection')</script></code>		<code><script>alert('XSS Code Injection')</script></code>
Line 55:		Line 54:

	=== Step 6 ===		=== Step 6 ===
	Once you submitted the form and forwarded the request to the server you need to either turn off the Interceptor because you have already sent the malicious code to the server (where it has been saved to the database) or forward all requests. After that you will be automatically redirected to the '''show-entry.html''' file where the malicious is loaded from the server (DB) and executed on the client browser.		Once you submitted the form and forwarded the request to the server you need to either turn off the Interceptor because you have already sent the malicious code to the server (where it has been saved to the database) or forward all requests. After that you will be automatically redirected to the '''show-entry.html''' file where the '''malicious code is loaded from the server (DB) and executed on the client browser'''.

	[[File:stored_xss_step5.png\|600px\|javascript code is executed]]		[[File:stored_xss_step5.png\|600px\|javascript code is executed]]

RHaidl at 11:22, 8 January 2023

2023-01-08T11:22:29Z

← Older revision		Revision as of 11:22, 8 January 2023
Line 27:		Line 27:

	Click on "'''Open Browser'''" in order to open the integrated Burp Suite browser.		Click on "'''Open Browser'''" in order to open the integrated Burp Suite browser.
	Once the browser started (it takes a while), open the '''add-entry.html''' file.		Once the browser started (it takes a while), open the '''add-entry.html''' file in it.

RHaidl at 11:21, 8 January 2023

2023-01-08T11:21:44Z

← Older revision		Revision as of 11:21, 8 January 2023
Line 26:		Line 26:
	=== Step 2 ===		=== Step 2 ===

	Click on "Open Browser" in order to open the integrated Burp Suite browser.		Click on "'''Open Browser'''" in order to open the integrated Burp Suite browser.
	Once the browser started (it takes a while), open the '''add-entry.html''' file.		Once the browser started (it takes a while), open the '''add-entry.html''' file.

RHaidl at 11:20, 8 January 2023

2023-01-08T11:20:54Z

@@ Line 1: / Line 1: @@
 == Summary ==
-This practical guide shows how to generate a stored XSS exploit using burp suite.
+This practical guide shows how to execute a stored XSS exploit using burp suite.
 == Requirements ==
@@ Line 14: / Line 14: @@
 ===Setup===
-* Download and run Burp Suite (https://portswigger.net/burp/communitydownload)
+* Download Burp Suite (https://portswigger.net/burp/communitydownload)
 * Clone GIT Project and run it locally using VisualStudios integrated IIS Express server.
 * Check if you can add blog entries
@@ Line 20: / Line 20: @@
 === Step 1 ===
-Open Burp Suite, navigate to Proxy -> Intercept and make sure to turn Intercept on.
+Open Burp Suite, navigate to Proxy -> Intercept and make sure to turn '''Intercept on'''.
-[[File:stored_xss_step1.png|600px|thumb|left|turn on intercept]]
+[[File:stored_xss_step1.png|600px|turn on intercept]]

RHaidl at 10:02, 8 January 2023

2023-01-08T10:02:22Z

← Older revision		Revision as of 10:02, 8 January 2023
Line 9:		Line 9:
	* GIT Project (https://github.com/Robert-Haidl/XSS_stored)		* GIT Project (https://github.com/Robert-Haidl/XSS_stored)

	In order to complete these steps, you must have followed the readme ([[https://github.com/Robert-Haidl/XSS_stored/blob/main/README.md]]) before.		In order to complete these steps, you must have followed the readme [https://github.com/Robert-Haidl/XSS_stored/blob/main/README.md] before.

	== Description ==		== Description ==

RHaidl at 10:01, 8 January 2023

2023-01-08T10:01:42Z

← Older revision		Revision as of 10:01, 8 January 2023
Line 22:		Line 22:
	Open Burp Suite, navigate to Proxy -> Intercept and make sure to turn Intercept on.		Open Burp Suite, navigate to Proxy -> Intercept and make sure to turn Intercept on.

	[[File:stored_xss_step1.png\|600px\|thumb\|~~right~~\|turn on intercept]]		[[File:stored_xss_step1.png\|600px\|thumb\|left\|turn on intercept]]

RHaidl: Created page with "== Summary == This practical guide shows how to generate a stored XSS exploit using burp suite. == Requirements == * Burp Suite * Visual Studio * GIT Project (https://github.com/Robert-Haidl/XSS_stored) In order to complete these steps, you must have followed the readme (https://github.com/Robert-Haidl/XSS_stored/blob/main/README.md) before. == Description == ===Setup=== * Download and run Burp Suite (https://portswigger.net/burp/communitydownload) * Clone GIT..."

2023-01-08T10:01:25Z

Created page with "== Summary == This practical guide shows how to generate a stored XSS exploit using burp suite. == Requirements == * Burp Suite * Visual Studio * GIT Project (https://github.com/Robert-Haidl/XSS_stored) In order to complete these steps, you must have followed the readme (https://github.com/Robert-Haidl/XSS_stored/blob/main/README.md) before. == Description == ===Setup=== * Download and run Burp Suite (https://portswigger.net/burp/communitydownload) * Clone GIT..."

New page

== Summary ==

This practical guide shows how to generate a stored XSS exploit using burp suite.

== Requirements ==

* Burp Suite
* Visual Studio
* GIT Project (https://github.com/Robert-Haidl/XSS_stored)

In order to complete these steps, you must have followed the readme ([[https://github.com/Robert-Haidl/XSS_stored/blob/main/README.md]]) before.

== Description ==

===Setup===
* Download and run Burp Suite (https://portswigger.net/burp/communitydownload)
* Clone GIT Project and run it locally using VisualStudios integrated IIS Express server.
* Check if you can add blog entries

=== Step 1 ===

Open Burp Suite, navigate to Proxy -> Intercept and make sure to turn Intercept on.

[[File:stored_xss_step1.png|600px|thumb|right|turn on intercept]]

== References ==

* https://portswigger.net/burp/documentation/desktop/penetration-testing

[[Category:Documentation]]