Member-only story
Visualizing XSS With Unusual Payloads
Typically, demonstrating Cross-Site Scripting (XSS) vulnerabilities involves one of two approaches:
- Look, I made your site display an alert.
- I’ve exfiltrated your cookies, credit card information and cat.
Not a member? Read this article for free on my site.
What if there was a third approach. Some more visual and maybe less malicious method, which would still demonstrate the potential impact of an XSS vulnerability? In this post I’m diving into some visual payloads, which aim to do just that. Have fun reading, and don’t take this one too seriously!
A quick heads-up before you start. While it’s technically possible to combine some of the payloads described below. I don’t recommend doing this, you’ll get sick.
Spoilers: If you make it all the way to the end, you’ll be rewarded with a Matrix-like payload!
This article is written for educational purposes and is intended only for legal penetration testing and red teaming activities, where explicit permission has been granted. The code examples serve the purpose of demonstrating the potential impact of an XSS attack. If you wish to test any of the scripts provided, please refer to the disclaimer at the end of this post.
Horrible Server
In a previous post I set up a pretty terrible Python server to demonstrate XSS. I’ve made it a bit worse, and upgraded its name to Horrible Server. This server is now vulnerable to a few variants of reflected XSS injection, but now also has a functional search function.
Before showing the entire script, lets zoom in on the vulnerable line:
<input id="q" name="q" type="text" class="form-control me-2" placeholder="Search..." value=\"""" + query + """\">The user input (query) is directly inserted into the HTML string, creating a false sense of security by enclosing it in double quotes.
Imagine searching for ?q=color" style="color:red;. Because of the double quote and direct injection, it breaks out of the HTML attribute, resulting in the following:
<input id="q" name="q" type="text" class="form-control me-2" placeholder="Search..." value="color"…
