SpellBook

Mon, 01 Jan 0001 00:00:00 +0000

Content Security Policies#

A CSP:

Is configured in the Content-Security-Policy response header
Consists of multiple directives. Each directive allows one or more values.

For instance, the script-src directive defines where JavaScript can be loaded and executed from:

Content-Security-Policy: script-src 'self' https://benignsite.htb

This CSP instructs the browser to load JavaScript only from the same origin as the page itself and the external origin https://benignsite.htb. Therefore, if an attacker injects the following JavaScript code in an XSS payload, the victim’s browser will not load the script and thus not execute it:

Mon, 01 Jan 0001 00:00:00 +0000

When this attribute is set to True, will prevent client from access cookie (via JavaScript). Specifically, when calling document.cookie, it will just return nothing

Bypass HTTPOnly#

Header Reflection#

If the page is sending the cookies as the response of a requests (for example in a PHPinfo page), it’s possible to abuse the XSS to send a request to this page and steal the cookies from the response

Mon, 01 Jan 0001 00:00:00 +0000

Same-Origin#

Same-Origin policy is a security mechanism implemented in web browsers to prevent cross-origin access to websites. In particular, JavaScript code running on one website cannot access a different website.

The origin is defined as the scheme, host, and port of a URL. eg:

http://localhost:80 is the same as http://localhost, but not the same as http://localhost:8080
But http://localhost is not the same as http://127.0.0.1
And http://localhost is also not the same as https://localhost.

JavaScript in browser can only send requests to the same origin.

Mon, 01 Jan 0001 00:00:00 +0000

WAF#

a WAF ( Web application firewall) blocks certain request based on a list of rules. For example, if request contains the string ' OR 1=1-- - then block

It blocks certain words in certain places like <script> in the URL, or alert, etc.

Some are easy to bypass, some are hard

Bypass WAF#

Use OWASP’s XSS Filter Evasion Cheat Sheet. Furthermore, there are collections of XSS payloads for different types of filters. For instance, if we are unable to use any parentheses, we may refer to the XSS without Parentheses payload collection

SpellBook

Content Security Policies#

HttpOnly Cookie Attribute#

Bypass HTTPOnly#

Header Reflection#

Same-Origin#

WAF#

Bypass WAF#