search

yehia-mamdouh / XSSYA

XSSYA (Cross Site Scripting Scanner & Vulnerability Confirmation)
Other
94 stars 35 forks source link

Undetected XSS vulnerability #3

Open Hax0rG1rl opened 10 years ago

Hax0rG1rl commented 10 years ago

Hi,

I've just test this one into the following test scenario:

  1. I've installed the DVWA application over a Windows 2003 Server virtual machine.
  2. I've chosen the XSS reflected from the exercises drop down.
  3. I've manually XSS'ed the application and I've got a XSS screen.
    The used patterns were and
  4. I've copied the vulnerable link and I've retested with XSSYA. See bellow:

"

Enter A Vulnerable Link: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name=

XSSYA - M E N U

  1. XSS Vulnerability Confirmation

  2. XSS Scanner

    Enter your choice [1-2] : 1

Date: Tue, 05 Aug 2014 07:34:02 GMT Server: Apache/2.4.7 (Win32) OpenSSL/0.9.8y PHP/5.4.25 X-Powered-By: PHP/5.4.25 Set-Cookie: PHPSESSID=e2to1m5drn7o6q7t1n143mk5h4; path=/ Expires: Tue, 23 Jun 2009 12:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Set-Cookie: security=low Content-Length: 1224 Connection: close Content-Type: text/html;charset=utf-8 "

It has been determined by the application that the link is not vulnerable to XSS which is not true.

Here are the application output: " Scanning The Host: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name= [+] Loaded: 28 payloads

Testing: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name=%22%3Cscript%3Ealert%28%27XSSYA%27%29%3C%2Fscript%3E Source Length: 1224

WAF Not Found

[-] Not Vulnerable.

[-] False Positive

Testing: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name=1%253CScRiPt%2520%253Eprompt%28962477%29%253C%2fsCripT%253E Source Length: 1224

WAF Not Found

[-] Not Vulnerable.

[-] False Positive

Testing: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name= Source Length: 1224

WAF Not Found

[-] Not Vulnerable.

[-] False Positive

Testing: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name='';!--"=&{()} Source Length: 1224

WAF Not Found

[-] Not Vulnerable.

[-] False Positive

Testing: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name=%3CScRipt%3EALeRt(%27xssya%27)%3B%3C%2FsCRipT%3E<scr Source Length: 1224

WAF Not Found

[-] Not Vulnerable.

[-] False Positive

Testing: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name=&lt;/script&gt;&lt;script&gt;alert(1)&lt;/script&gt; Source Length: 1224

WAF Not Found

[-] Not Vulnerable.

[-] False Positive

Testing: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name=<scri%00pt>alert(1);</scri%00pt> Source Length: 1224

WAF Not Found

[-] Not Vulnerable.

[-] False Positive

Testing: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name=<scri%00pt>confirm(0);</scri%00pt> Source Length: 1224

WAF Not Found

[-] Not Vulnerable.

[-] False Positive

Testing: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name=5rt(0);'>rhainfosec Source Length: 1224

WAF Not Found

[-] Not Vulnerable.

[-] False Positive

Testing: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name= Source Length: 1224

WAF Not Found

[-] Not Vulnerable.

[-] False Positive

Testing: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name=<marquee/onstart=confirm(2)> Source Length: 1224

WAF Not Found

[-] Not Vulnerable.

[-] False Positive

Testing: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name=XSS Source Length: 1224

WAF Not Found

[-] Not Vulnerable.

[-] False Positive

Testing: http://192.168.2.130/dvwa/vulnerabilities/xss_r/?name=<svg/onload=prompt(1);> Source Length: 1224

WAF Not Found

[-] Not Vulnerable.

[-] False Positive

Save Page CODE:? y

Print HTML CODE:? y Date: Tue, 05 Aug 2014 07:36:37 GMT Server: Apache/2.4.7 (Win32) OpenSSL/0.9.8y PHP/5.4.25 X-Powered-By: PHP/5.4.25 Set-Cookie: PHPSESSID=0l288no7jicbm4u69df3ksqjf6; path=/ Expires: Tue, 23 Jun 2009 12:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Set-Cookie: security=low Content-Length: 1224 Connection: close Content-Type: text/html;charset=utf-8 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

Damn Vulnerable Web App (DVWA) - Login ... "
Hax0rG1rl commented 10 years ago

The XSS patterns pictures. From some security reasons, github don't let me to have them narrowed down as clear text.

screenshot from 2014-08-05 10 38 08

screenshot_2

yehia-mamdouh commented 7 years ago

Check XSSYA V2 https://github.com/yehia-mamdouh/XSSYA-V-2.0