-2

I tested site for vulnerables (folder /service-contact) and possible XSS DOM issue came up (using Kali Linux, Vega and XSSER). However, i tried to manually test url with 'alert' script to make sure it's vulnerable. I used

www.babyland.nl/service-contact/alert("test") No alert box/pop-up was shown, only the html code showed up in contact form box.

I am not sure i used the right code (i'm a rookie) or did the right interpretation. Server is Apache, using javascript/js.

Can you help?

Thanks!

Jim
  • 1
  • 2
  • It doesn't appear that that site is vulnerable to XSS (at least through the vector you suggested). Sounds like a false positive in your scanner. – Gray Jan 14 '16 at 19:07

2 Answers2

1

This is Not Vulnerable to XSS, Whatever you are writing in the URL is Coming in Below Form section ( Vraag/opmerking ) . And the Double Quotes (") are Escaped. If you try another Payload like <script>alert(/xss/)</script> That Also won't work, Because this is Not Reflecting neither Storing. You will see output as a Text in Vraag/opmerking. Don't Rely on Online Scanners, Test Manually, For DOM Based XSS ..Check Sink and Sources and Analyze them.

Aaditya Purani
  • 11
  • 3
0

The tool is right. There is a XSS-Vulnerability on the site, but the proof of concept (PoC) code is wrong. The content of a <textarea> can only contain character data (see <textarea> description on MDN). So your <script>alert("test")</script> is interpreted as text and not as HTML code. But you can close the <textarea> tag and insert the javascript code after that.

Here is the working PoC URL:

https://www.babyland.nl/service-contact/</textarea><script>alert("test")</script>

which is rendered as:

<textarea rows="" cols="" id="comment" name="comment"></textarea<script>alert("test")</script></textarea>

A little note to testing for XSS injection: Chrome/Chromium has a XSS protection. So this code doesn't exploit in this browser. For manual testing you can use Firefox or run Chrome with: --disable-web-security (see this StackOverflow Question and this for more information).

sven.to
  • 270
  • 2
  • 7