[Part 1] What is XSS and Example of Filters & Bypasses

Hi again XD and another topic in this one we will talk about Cross Site-Scripting (XSS).

What is XSS?

it's a type of injection bugs which enables the attackers to inject Client-Side scripts into the web page, there are two common types of XSS:
Reflected XSS: works where the malicious string originates from the victim's request, the second one 

Stored XSS: works where the malicious string originates from the website's database.

DOM-based XSS: works where the vulnerability is in the client-side code rather than the server-side code.

How to exploit XSS?

let's start with basic XSS and go over to some XSS filters and bypasses, now if we have a link like that

http://example.com/path/urname.php?name=flex

the response on the web page will be Welcome flex if we try to inject a JS script on the parameter name like

<script>alert('XSS')</script>

if I add it to the parameter name the website will take and print it on the web page and the JS script will be executed on the page and alert XSS and this the basic XSS, this is a basic vulnerable PHP code

<?php

echo "Welcome ".$_GET['name'];

?>

About filters and bypasses let's talk about the first one is the block list when you try to execute XSS payload like

<svg onload=alert(1337)>

some websites add a blocklist to block alert what can I use in this case? you can replace it with 

prompt
confirm
write

these three can do the same but write will delete the page content and add the value, now there is another thing if this ( ) blocked what I can use? you can replace it with ` ` and it will work but it will not get the documents information like domain and cookies, what if all of them deleted? you can easily get an external file using

<script src="link_to_js_file"></script>

the JS file should include the code that you want to execute on the victim and the website will use it when you add the above script.

what if the script tag is blocked? you can use other tags and these tags use a specific event for example:

<svg onload=js_code_here>
<img src=x onerror=js_code_here>
<marquee onstart=js_code_here>anything_here

these tags aren't the only tags you can use there is a lot and you can create your own payload to exploit XSS not all XSS like each other.

there is an XSS on links like a tag or iframe tag how is that? by using the javascript protocol, how is that? look with me, if I used this tag

<a href="javascript:alert(1337)">click here</a>

the URL of this word click here is javascript:alert(1337) what is that? try to write it on your browser it will pop-up with 1337 this is a protocol for javascript so anyone will clock on this word click here the JS code will be executed on him, there is another tag it's iframe which includes a file or website content on the web page, what if I added the javascript protocol? right it will execute the JS code and the payload is

<iframe src=javascript:alert(1337)>

it will pop-up with 1337.

in the end, this is not all of the filters and bypasses it just the beginning and I will say it again you can create your own payload and soon I will write Part 2 of this topic with more filters and bypasses and real XSS bugs I found.

see you soon, Goodbye.