Reflected XSS protected by very strict CSP, with dangling markup attack - Lab#29

Reflected Cross-Site Scripting Vulnerability Lab Overview

Introduction to the Lab

• Muhammad Badja introduces the lab focused on reflected cross-site scripting (XSS) vulnerabilities, specifically using a strict Content Security Policy (CSP).

• The lab requires performing an XSS attack that bypasses CSP to exfiltrate a simulated victim's CSRF token using Burp Collaborator.

• A mandatory requirement is highlighted: the payload must include the word "click" to induce user interaction.

Initial Setup and Credentials

• Users are instructed not to interact with external systems; instead, they should use the provided exploit server for testing.

• Valid login credentials are shared: username "Wier" and password "Peter" for accessing the lab environment.

Understanding Form Structure

• Muhammad discusses challenges faced in previous attempts at solving the lab, emphasizing trial and error in finding effective payloads.

• He inspects the email change form, noting its structure and hidden CSRF token field essential for changing email addresses.

Exploring Content Security Policy

• The importance of CSRF tokens is reiterated; each user has a unique token embedded within their forms.

• Muhammad demonstrates how attempting to load resources from external domains fails due to strict CSP settings blocking such actions.

Implementing Dangling Markup Attack

Concept of Dangling Markup

• Dangling markup refers to improperly terminated HTML code that can lead to security vulnerabilities when untrusted input is included without proper validation.

Creating Custom Forms

• Muhammad explains how he will create a custom form after terminating the existing one, allowing him to control inputs more effectively.

Payload Construction and Testing

Building Exploit Payload

• The process of redirecting users through an exploit server is outlined, aiming to capture CSRF tokens upon clicking malicious links.

Capturing User Interaction

• A script is crafted that sends requests back to an attacker-controlled server when executed by a victim who clicks on it.

Finalizing CSRF Token Exfiltration

Submitting Change Email Request

• Challenges arise when trying to submit email changes due to mismatched session IDs and CSRF tokens between users' sessions.

Crafting Final Payload

• Muhammad emphasizes creating a complete HTML page with forms that automatically submits once loaded, ensuring both session ID and CSRF token are utilized correctly.

Conclusion of Lab Process

Successful Execution of Exploit

• After multiple attempts, Muhammad successfully captures another user's CSRF token by having them click his crafted link leading them back through his exploit server.

This structured summary encapsulates key insights from each segment of the transcript while adhering strictly to timestamp requirements for easy reference.