[Day 5] 1. Web Exploits XSS and Command Injection

XSS: Cross-Site Scripting

What is Cross-Site Scripting (XSS)?

Cross-Site Scripting is a security vulnerability that allows attackers to inject malicious scripts into webpages viewed by other users. These scripts are often used to steal session IDs, hijack user sessions, or manipulate website content.

Learning Pre-requisites

To understand XSS better, it's helpful to have basic knowledge of web development:

HTML, CSS, and JavaScript
- Resource: W3Schools
  Study these whenever you have time to strengthen your foundational web development skills.

What Happens if XSS is Allowed?

Attackers can steal session IDs using XSS.
Session Hijacking: With a stolen session ID, attackers can impersonate an authorized user and gain access to the website without requiring credentials (username or password).

Example Code to Extract Session ID

Insert the following malicious script into a vulnerable webpage's input field:

html
<script>alert(document.cookie)</script>

This script will display the session ID of the logged-in user in an alert box.
Copy this session ID for further exploitation.

Exploiting the Session ID Using Burp Suite

Open Burp Suite.
Use the session ID you copied from the previous step.
Modify and forward the packet using the stolen session ID:
- Replace the session ID in two packets.
Once completed, you'll gain access to the website without needing credentials.

Cross-Site Scripting: Reflected XSS

Reflected XSS vulnerabilities occur when malicious input is sent via the URL or form fields and is reflected back as part of the webpage's response.

Example: Playing with the URL or manipulating
```
HTML
```
parameters.
Notes: The character
```
/
```
and its encoded counterpart
```
%2F
```
can sometimes be relevant in crafting payloads.

Command Injection

Also known as Remote Command Execution (RCE), this vulnerability allows attackers to execute arbitrary commands on the server, potentially crashing it or gaining control.

Extra: What is a No-Login Shell?

A no-login shell restricts a user from logging into the system or using the shell.

Example Command:

bash
usermod tinku -s /usr/sbin/nologin

Output for the user
```
tinku
```
:
This account is currently unavailable.
Use this to secure accounts that do not require shell access.