DEV Community: sachiko-kame

Things I thought I should be careful about when writing my own XSS penetration tests.

sachiko-kame — Sat, 25 Feb 2023 12:21:14 +0000

Introduction

This is an article that I google translated my article and reviewed a little.🙇‍♀️

Sorry for my bad English.🙇‍♀️

There are some parts that are omitted.🙇‍♀️

The article is below. (Japanese)🙇‍♀️
https://qiita.com/sachiko-kame/items/d6128c0674a75f5ec809

in the world,
Penetration testing tools such as OWASP ZAP,
There are useful XSS checking strings such as XSS Locator (Polygot).

but,
How far can this be detected?
How should I test it in the first place?
Are there any precautions for inspection?
How can I write an XSS Penetration Test to detect more XSS?
I think there are many things to think about!

I thought about such a variety of things, so as a result of actually doing it,
I would like to write about what I think you should be careful about when writing your own XSS penetration test!
thank you!

Here's a github link for you to try!

『OWASP ZAP』 VS 『XSS Locator (Polygot)』

First of all, on the page with various vulnerabilities,
I checked how much it can detect with "OWASP ZAP" and "XSS Locator (Polygot)"!

There are various things I picked up from various sites and things I made by looking at Polygot's character strings.

You can see a lot by looking at the table below.
・Both light XSS can be detected to some extent.
・there Are times when "OWASP ZAP" does not check the scheme ■sample-a9
・Both of them basically cannot detect vulnerabilities using regular expressions.
・Both of them are basically unable to detect vulnerabilities at error locations.
・"owasp zap" is less detectable than "XSS Locator (Polygot)".
・ "XSS Locator (Polygot)" may not be detected if the detection method or input is wrong. (details later)

	Examples of expected values to be entered during normal operation	OWASP ZAP	XSS Locator (Polygot)
Escape omission in <title> * sample-a1	1	Detected	Detected
Escape omission in <style> *sample-a2	red	Detected	Detected
Omission of escaping in <textarea> *sample-a3	This is my first post!	Detected	Detected
Escape omission in <script> ※sample-a4	sss	Detected	Detected
Escape omission in <xmp> ※sample-a5	sample	Detected	Detected
Escape omission in <pre> ※sample-a6	sample	Detected	Detected
Insufficient escaping *sample-a7 Unescaped 『'』 and『"』	red	Detected	Detected
Insufficient escaping *sample-a8 Unescaped 『'』 and『"』	"color: red"	Not detected	Detected (Enclosed in "" required)
url scheme check omission ※sample-a9	`https://sachiko-kame.github.io/`	cannot be detected	detected
Omission of escaping where php string output is enclosed in HTML comments *sample-b1	sample	Detected	Detected
Inappropriate escaping *Sample-b2 php output is surrounded by js escape function	sample	Detected	Detected
Escape leak in for statement ※sample-b3	Nice weather#Event#Weather#aaa	Detected	Detected (must be entered after #)
Escape omission in the for statement *Sample-b4 I added processing to play only the characters in the script	It's a nice weather#Event#Weather#aaa	Detected	Detected (Behind # required)
Insufficient checking due to user input in regular expression (in php code) *sample-b5 Do not create basic regular expression with user input	`https://sachiko-kame.github.io#abc`	Undetectable	Undetectable
Insufficient check due to user input in regular expression (in js code) *sample-b6 Do not create basic regular expression with user input	`https://sachiko-kame.github.io#abc`	Undetectable	Undetectable
Insufficient checking due to some user input in the regular expression (in php code) *sample-b7 Basic regular expression is not created with user input	`http://192.168.99.100:86/sample- b7/?name=sachiko`	Undetectable	Undetectable
Insufficient checking due to some user input in the regular expression (in js code) *sample-b8 Basic regular expression is not created with user input	`http://192.168.99.100:86/sample- b8/?name=sachiko`	Undetectable	Undetectable
Escape leak after putting prefix in style class description * sample-b9	php	Cannot be detected	Detected
Escape omission of error output wording of trycatch *sample-c1	sample	Cannot be detected	Cannot be detected
iframe url scheme check omission * sample-c2	`https://sachiko-kame.github.io/`	Detected	Detected

"XSS Locator (Polygot)" may not be detected if the detection method or input is wrong.

It may be natural, but

You should put the value of "XSS Locator (Polygot)" where the user can freely enter.
If there is an instruction to insert a character specified by the system in a place where the user can freely enter, the character specified by the system + "XSS Locator (Polygot)" should be inserted.

If you can enter anything after "#" ……

○
https://sachiko-kame.github.io#<<Polygot value>>

×
<<Polygot value>>

×(I really want to do this if possible)
https://sachiko-kame.github.io/<<Polygot value>>

If you are instructing to enclose the input value with ""……

○
"<<Polygot value>>"

×(I really want to do this if possible)
<<Polygot value>>

Summary of things I thought I should be careful about when creating my own XSS penetration test

The inspection will be conducted without WAF.
If there is a WAF, it seems that there are cases where the attack could not be detected because it was repelled by the WAF.
Basically, the attack code uses XSS Locator (Polygot) and |.|.
As you can see from the table above, this can detect to some extent, so I feel that this is the appropriate attack code. |.| is explained again a little later.
First, output the normal pattern of the system. ex) If you do 〇〇, it will behave as 〇〇.
On the contrary, to look for suspicious things that do not behave this way. I think it would be difficult to find vulnerabilities in regular expressions without doing something like this.

example
・If you type 〇〇 in the form, 〇〇 will be displayed in this place.
・If you type red in the form, this place will turn red.
・If you type "sample" in the form, it will be URL#sample here and the appropriate part will be displayed when you click it.

Identify areas where users can freely enter data. Reference: sample-b3
To put the attack code here and inspect it.
Where the user can freely input + If there is anything the system is asking for, it will also be identified. Enclose in "". Reference: sample-a8
To put the attack code here and inspect it.
When diagnosing vulnerability (on your own), try clicking and focusing to see if there is any difference from normal behavior. Reference: sample-a7
Assuming when js is installed in the event handler or src

example
・Check that js does not fire without doing anything.
・Confirm that js is not fired by hitting the form.
・Check that js does not fire when clicked.
・Check if the behavior is normal and expected behavior.

Check whether it fires even when an error occurs. *Reference: sample-c1
It's like inserting an attack code and checking it when an error occurs.
Basically, I think that it will be like entering and confirming with "<<character string that causes an error>><<Polygot>>".
Considering the possibility of regular expressions, it is suspicious if characters that always behave differently and do not behave as intended.
I feel like I'm going to put in a character that looks like a bug and detect it!

For example:

|.|

I've tried to show what I've tried in the table below.

①
↓

|.|

inspected pattern	what you entered	What behavior was normal?	What is the behavior of the bug
sample-b5	`https://sachiko-kame.github.io#①`	Clickable URL =>`https://sachiko-kame.github.io`	Clickable URL =>`http://192.168.99.100:86/sample-b5/?name=https%3A%2F%2Fsachiko-kame.github.io%23%7C.%7C`
sample-b6	`https://sachiko-kame.github.io#①`	Clickable URL =>`https://sachiko-kame.github.io`	Clickable URL =>`http://192.168.99.100:86/sample-b6/`
sample-b7	`http://192.168.99.100:86/sample-b7/?①=①`	image url => `https://sachiko-kame.github.io/images/sachiko.png`	A lot of ① are displayed
sample-b8	`http://192.168.99.100:86/sample-b8/?①=①`	image url => `https://sachiko-kame.github.io/images/sachiko.png`	A lot of ① are displayed

Confirmation that the intended tag is not included. If you don't go this far, you won't be able to find it completely sample-c1
As a bonus, if there is a tag that is allowed where you are entering a long sentence, it might be better if you could enter an event handler there and check if it doesn't fire at all. I'm thinking. I wrote this as a bonus.

lastly

Thank you for reading to the end! !🙇‍♀️

CakePHP Form button Customize

sachiko-kame — Mon, 21 Sep 2020 14:21:21 +0000

how to

Add the class you want to adapt to create

<?= $this->Form->create(null, ['class'=> 'aaa' , 'url' => ['controller' => 'Advices', 'action' => 'heart']]); ?>
<?= $this->Form->hidden( 'advice_id', ['value'=>$advices->id ]); ?>
<?= $this->Form->button(__('Heart')) ?>
<?= $this->Form->end() ?>

How to write on the button of the class

.aaa .button, .aaa button, .aaa input[type='button'], .aaa input[type='reset'], .aaa input[type='submit'] .aaa {
    background-color: #db116c;
    border: 0.1rem solid #db116c;
}

Appearance after change

A little more

Image of unpressed heart

<?= $this->Form->button(__('♡')) ?>

.aaa .button, .aaa button, .aaa input[type='button'], .aaa input[type='reset'], .aaa input[type='submit'] .aaa {
    background-color: #f1f2f4;
    border: 0.1rem solid #606c76;
    -moz-border-radius: 50%;
    -webkit-border-radius: 50%;
    border-radius: 50%;
    font-size: 2rem;
    color: #606c76;
}

Image of pressed heart

<?= $this->Form->button(__('♥')) ?>

.aaa .button, .aaa button, .aaa input[type='button'], .aaa input[type='reset'], .aaa input[type='submit'] .aaa {
    background-color: #db116c;
    border: 0.1rem solid #db116c;
    -moz-border-radius: 50%;
    -webkit-border-radius: 50%;
    border-radius: 50%;
    font-size: 2.3rem;
    color: white;
}

Form Helper【CakePHP】

sachiko-kame — Mon, 21 Sep 2020 09:49:56 +0000

Introduction

Please watch over gently🙇‍♀️
I will write about cakePHP "Form Helper"!
List of things you will often see.

Overall picture

<?= $this->Form->create(null, ['url' => ['controller' => 'Advices', 'action' => 'index']]); ?>
<?= $this->Form->control('title', ['type' => 'text']); ?>
<?= $this->Form->hidden( 'user_id', ['value'=>$userID]); ?>
<?= $this->Form->button(__('tap')) ?>
<?= $this->Form->end() ?>

Create

Cake\View\Helper\FormHelper::create(mixed $context = null, array $options = [])

Basic

$this->Form->create(null);

change action

$this->Form->create(null, ['url' => ['action' => 'publish']]);

change controller & action

$this->Form->create(null, [
    'url' => [
        'controller' => 'Articles',
        'action' => 'publish'
    ]
]);

External

$this->Form->create(null, [
    'url' => 'http://www.google.com/search'
]);

Control

Cake\View\Helper\FormHelper::control(string $fieldName, array $options = [])

Basic

$this->Form->control('title', ['type' => 'text']);

$this->Form->control('title', ['type' => 'checkbox']);

$this->Form->textarea('advice', ['rows' => '3']);

Hide

$this->Form->hidden( 'article_id', ['value'=>'1' ]);

?$this->Form->hidden('id');

Remove required

$this->Form->control('title', ['required' => false]);

button

$this->Form->button('Add');

end

$this->Form->end();

reference

Create cell【CakePHP】

sachiko-kame — Sun, 06 Sep 2020 09:22:29 +0000

Introduction

Please watch over gently🙇‍♀️
I will write about cakePHP "cell"!

How to use

Create 'class' and 'template'

[src/View/Cell/InboxCell.php]

<?php
namespace App\View\Cell;

use Cake\View\Cell;

class InboxCell extends Cell
{

    public function display()
    {
      $hello = "hello!!!(*´ω｀*)";
      $this->set('sample', $hello);
    }

}

[templates/cell/Inbox/display.php]

<div>
    message✨ <?= $sample ?> 
</div>

use

On the "/templates/????/index.php"

The following description

<?=$this->cell('Inbox::display');?>

display

http://〇〇/????

A little more

Show what you get in the model

Assumption: You have a created model.This time 'tags'

[src/View/Cell/InboxCell.php]

<?php
namespace App\View\Cell;

use Cake\View\Cell;

class InboxCell extends Cell
{

    public function display()
    {
      $this->loadModel('Tags');
      $tags = $this->Tags->find();
      $this->set('tags', $tags);
    }

}

[templates/cell/Inbox/display.php]

<table>
  <?php foreach ($tags as $tag): ?>
    <tr>
      <td><?= $tag->title ?></td>
    </tr>
  <?php endforeach; ?>
</table>

Where you want to use↓

<?=$this->cell('Inbox::display');?>

display

Overall picture

Don't forget the escape

I forgot,
So I will not forget
↓
[templates/cell/Inbox/display.php]

h($tag->title)

reference

I tried using CakePHP 4.0.8 🍓with Docker. (apach)

sachiko-kame — Sun, 31 May 2020 02:34:18 +0000

Introduction

☀️日本語バージョン

☀️github

I'm going to write the procedure I'm writing on my_github here.

Thank you.

Step1 Up to the necessary container creation!

clone
$ git clone https://github.com/sachiko-kame/docker_cakePHP.git

Clone and use the following command where docker-compose.yml file exists
$ docker-compose up --build -d

Check if the container was created successfully
$ docker ps

output👁

d6e752c1a5b7        2020_5_30_template_cakephp_apach   "docker-php-entrypoi…"   4 seconds ago       Up 4 seconds        0.0.0.0:80->80/tcp                  sample-apache-container1
602a4868b08b        2020_5_30_template_cakephp_mysql   "docker-entrypoint.s…"   4 seconds ago       Up 4 seconds        0.0.0.0:3306->3306/tcp, 33060/tcp   sample-mysql1

ip check
$ docker-machine ip default

output👁

***.***.**.***

Confirm the pasted ip on your browser.

Step2 Enter apache container and install cakePHP

Enter the Apache container. The following command. d6e752c1a5b7, please put your own
$ docker exec -i -t d6e752c1a5b7 bash

apache　in🚪
root@d6e752c1a5b7:/var/www/html#

put composer
$ curl -sS https://getcomposer.org/installer | php

put cakePHP in composer
$ php composer.phar create-project --prefer-dist cakephp/app:4.* my_app_name

Set Folder Permissions ? (Default to Y) [Y,n]? → y → enter!

Move the contents of the cakePHP folder
$ mv my_app_name/* /var/www/html/

output👁

root@d6e752c1a5b7:/var/www/html# ls
README.md  bin  composer.json  composer.lock  composer.phar  config  index.php  logs  my_app_name  phpcs.xml  phpunit.xml.dist  plugins  resources  src  templates  tests  tmp  vendor  webroot

If you reload the browser and it looks like the following, it's OK !!

It is OK to reload again as below !!

Exit the container
$ exit

apache　out🚪

Setp3 Resolving any errors

The reason is a problem with file permissions, so
The following command.
$ chmod -R 777 apach/html/logs
$ chmod -R 777 apach/html/tmp

OK if you reload the browser and the error disappears

Step4 Create a database in Mysql container and complete the cakePHP database connection.

Enter the mysql container. 602a4868b08b, please put your own
$ docker exec -i -t 602a4868b08b bash

mysql　in🚪
root@602a4868b08b:/#

If you are asked a password, you can use example
By the way, the password will not be displayed even if you type it!
output👁

Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 8
Server version: 8.0.20 MySQL Community Server - GPL

Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>

Create a database for this time in the mysql container

$ create database mydb01;
$ show databases; ← Just a confirmation command

exit from mysql container
You can get out by hitting $ exit; twice!

mysql　out🚪

Modify the cakePHP file to connect to the database. Change the Datasources of "/apach/html/config/app_local.php" as follows.

    'Datasources' => [
        'default' => [
          'className' => 'Cake\Database\Connection',
          'driver' => 'Cake\Database\Driver\Mysql',
          'persistent' => false,
          'encoding' => 'utf8mb4',
          'timezone' => 'UTC',
          'cacheMetadata' => true,

          'host' => 'mysql',
            /*
             * CakePHP will use the default DB port based on the driver selected
             * MySQL on MAMP uses port 8889, MAMP users will want to uncomment
             * the following line and set the port accordingly
             */
            //'port' => 'non_standard_port_number',

            'username' => 'root',
            'password' => 'example',

            'database' => 'mydb01',
            /**
             * If not using the default 'public' schema with the PostgreSQL driver
             * set it here.
             */
            //'schema' => 'myapp',

            /**
             * You can use a DSN string to set the entire configuration
             */
            'url' => env('DATABASE_URL', null),
        ],

If possible, I think that the database connection can be made as follows.

Step5 Set up around apache so that cakePHP can be rewritten

apache　in🚪
Enter the apache container
$ docker exec -i -t d6e752c1a5b7 bash

Command depression to activate the rewrite module
$ a2enmod rewrite
$ service apache2 restart

apache　out (auto)🚪
Build Docker again
$ docker-compose up --build -d

If there is a file that has not been moved as follows, move it

It is OK if you hit it in the form of ip address / pages and return to the ip address!

The my_app_name folder is empty so delete it!

Step6 Create a little page and check the display.

Move to /apach/html and create a controller for user with the following command.
$ bin/cake bake controller users

Modify the following files created by the command
/apach/html/src/Controller/UsersController.php
Comment out in index () as follows

    public function index()
    {
        //$users = $this->paginate($this->Users);

        //$this->set(compact('users'));
    }

Then create a users folder in the /apach/html/templates folder. Create index.php file in it
There is no problem if you write something like the following in index.php!
<h1>sample!!!</h1>

Finally

It was my first post on dev.to!✨
Thank you for reading to the end!ヽ(´▽｀)/