{"id":771,"date":"2021-03-24T09:33:46","date_gmt":"2021-03-24T09:33:46","guid":{"rendered":"https:\/\/cas.cybercop-training.ch\/?page_id=771"},"modified":"2021-03-24T15:14:46","modified_gmt":"2021-03-24T15:14:46","slug":"xss-dom-based","status":"publish","type":"page","link":"https:\/\/cas.cybercop-training.ch\/index.php\/xss-dom-based\/","title":{"rendered":"XSS – DOM Based"},"content":{"rendered":"

Exercise XSS – DOM based<\/h1>\n

1. Introduction<\/h2>\n

Hack and fix the DOM-based vulnerable web site.<\/p><\/blockquote>\n

Your goal is to find and exploit the DOM based XSS vulnerability.<\/p>\n

Fix the vulnerable web site using the built-in Theia Web IDE
\nIf you see something like this, you’re good:<\/p>\n

\"\"<\/p>\n

Please answer to the following questions:<\/p>\n

    \n
  1. Explain the meaning of # in the URL<\/li>\n
  2. Explain the difference between Stored XSS, Reflected XSS and DOM based XSS<\/li>\n
  3. Explain the fix in the last step<\/li>\n<\/ol>\n

    2. Answer and solution<\/h2>\n

    On the get in touch<\/code> section where we can switch between different locations we can find the DOM based XSS vulnerability.<\/p>\n

    start.html#<script>alert(1)<\/script><\/pre>\n
    The following example will show a javascript alert<\/code> popup, when we add a script tag.<\/p>\n
    \"\"<\/p>\n
      \n
    1. In jQuery #<\/code> is known as id selector<\/code> and selects a single element with the given id attribute.
      \nCalling jQuery()<\/code> (or $())<\/code> with an id selector as its argument will return a jQuery object containing a collection of either zero or one DOM element.<\/li>\n<\/ol>\n
      Each id value must be used only once within a document. If more than one element has been assigned the same ID, queries that use that ID will only select the first matched element in the DOM. This behavior should not be relied on, however; a document with more than one element using the same ID is invalid.<\/p><\/blockquote>\n
      2.1 XSS Summary<\/h3>\n
      Stored XSS<\/h3>\n
      Stored XSS, also known as persistent XSS, occurs when a malicious script is injected directly into a vulnerable web application.<\/p><\/blockquote>\n
      Reflected XSS<\/h3>\n
      Reflected XSS involves the reflecting of a malicious script off of a web application, onto a user\u2019s browser. The script is embedded into a link, and is only activated once that link is clicked on.<\/p><\/blockquote>\n
      DOM based XSS<\/h3>\n
      In DOM-based XSS, the malicious JavaScript is executed at some point after the page has loaded, as a result of the page’s legitimate JavaScript treating user input in an unsafe way<\/p><\/blockquote>\n
      3. Issue fix<\/h2>\n
      The issue can be fixed if the inline html code will be displayed as text instead of html.<\/p>\n
      var loc = decodeURIComponent(location.hash.slice(1));\r\n            $('#locationName').text(loc);<\/pre>\n
      \"\"<\/p>\n
      Before fix:<\/p>\n
      start.html#<s>Headquarters<\/s><\/pre>\n
      \"\"<\/p>\n
      After fix:<\/p>\n
      \"\"<\/p>\n","protected":false},"excerpt":{"rendered":"
      Exercise XSS – DOM based 1. Introduction Hack and fix the DOM-based vulnerable web site. Your goal is to find and exploit the DOM based XSS vulnerability. Fix the vulnerable web site using the built-in Theia Web IDE If you see something like this, you’re good: Please answer to the following questions: Explain the meaning […]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-771","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages\/771","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/comments?post=771"}],"version-history":[{"count":4,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages\/771\/revisions"}],"predecessor-version":[{"id":883,"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/pages\/771\/revisions\/883"}],"wp:attachment":[{"href":"https:\/\/cas.cybercop-training.ch\/index.php\/wp-json\/wp\/v2\/media?parent=771"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}