9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.973 High
EPSS
Percentile
99.8%
Unfiltered ‘>’ (greater than sign). An indication of potential XSS vulnerability.
The pages that contain the forms to exploit. For example, {/upload.php, /login.php}. Default: nil (crawler mode on)
The pages that reflect back POSTed data. For example, {/comments.php, /guestbook.php}. Default: nil (Crawler mode on)
The script will try to fill every field found in the form but that may fail due to fields’ restrictions. You can manually fill those fields using this table. For example, {gender = “male”, email = “[email protected]”}. Default: {}
The path of a plain text file that contains one XSS vector per line. Default: nil
See the documentation for the slaxml library.
See the documentation for the httpspider library.
See the documentation for the smbauth library.
See the documentation for the http library.
nmap -p80 --script http-stored-xss.nse <target>
This script works in two phases.
1) Posts specially crafted strings to every form it encounters.
2) Crawls through the page searching for these strings.
If any string is reflected on some page without any proper
HTML escaping, it's a sign for potential XSS vulnerability.
PORT STATE SERVICE REASON
80/tcp open http syn-ack
| http-stored-xss:
| Found the following stored XSS vulnerabilities:
|
| Payload: ghz>hzx
| Uploaded on: /guestbook.php
| Description: Unfiltered '>' (greater than sign). An indication of potential XSS vulnerability.
| Payload: zxc'xcv
| Uploaded on: /guestbook.php
| Description: Unfiltered ' (apostrophe). An indication of potential XSS vulnerability.
|
| Payload: ghz>hzx
| Uploaded on: /posts.php
| Description: Unfiltered '>' (greater than sign). An indication of potential XSS vulnerability.
| Payload: hzx"zxc
| Uploaded on: /posts.php
|_ Description: Unfiltered " (double quotation mark). An indication of potential XSS vulnerability.
description = [[
Posts specially crafted strings to every form it
encounters and then searches through the website for those
strings to determine whether the payloads were successful.
]]
---
-- @usage nmap -p80 --script http-stored-xss.nse <target>
--
-- This script works in two phases.
-- 1) Posts specially crafted strings to every form it encounters.
-- 2) Crawls through the page searching for these strings.
--
-- If any string is reflected on some page without any proper
-- HTML escaping, it's a sign for potential XSS vulnerability.
--
-- @args http-stored-xss.formpaths The pages that contain
-- the forms to exploit. For example, {/upload.php, /login.php}.
-- Default: nil (crawler mode on)
-- @args http-stored-xss.uploadspaths The pages that reflect
-- back POSTed data. For example, {/comments.php, /guestbook.php}.
-- Default: nil (Crawler mode on)
-- @args http-stored-xss.fieldvalues The script will try to
-- fill every field found in the form but that may fail due to
-- fields' restrictions. You can manually fill those fields using
-- this table. For example, {gender = "male", email = "[email protected]"}.
-- Default: {}
-- @args http-stored-xss.dbfile The path of a plain text file
-- that contains one XSS vector per line. Default: nil
--
-- @output
-- PORT STATE SERVICE REASON
-- 80/tcp open http syn-ack
-- | http-stored-xss:
-- | Found the following stored XSS vulnerabilities:
-- |
-- | Payload: ghz>hzx
-- | Uploaded on: /guestbook.php
-- | Description: Unfiltered '>' (greater than sign). An indication of potential XSS vulnerability.
-- | Payload: zxc'xcv
-- | Uploaded on: /guestbook.php
-- | Description: Unfiltered ' (apostrophe). An indication of potential XSS vulnerability.
-- |
-- | Payload: ghz>hzx
-- | Uploaded on: /posts.php
-- | Description: Unfiltered '>' (greater than sign). An indication of potential XSS vulnerability.
-- | Payload: hzx"zxc
-- | Uploaded on: /posts.php
-- |_ Description: Unfiltered " (double quotation mark). An indication of potential XSS vulnerability.
--
-- @see http-dombased-xss.nse
-- @see http-phpself-xss.nse
-- @see http-xssed.nse
-- @see http-unsafe-output-escaping.nse
categories = {"intrusive", "exploit", "vuln"}
author = "George Chatzisofroniou"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
local http = require "http"
local io = require "io"
local string = require "string"
local httpspider = require "httpspider"
local shortport = require "shortport"
local stdnse = require "stdnse"
local table = require "table"
portrule = shortport.port_or_service( {80, 443}, {"http", "https"}, "tcp", "open")
-- A list of payloads.
--
-- You can manually add / remove your own payloads but make sure you
-- don't mess up, otherwise the script may succeed when it actually
-- hasn't.
--
-- Note, that more payloads will slow down your scan.
payloads = {
-- Basic vectors. Each one is an indication of potential XSS vulnerability.
{ vector = 'ghz>hzx', description = "Unfiltered '>' (greater than sign). An indication of potential XSS vulnerability." },
{ vector = 'hzx"zxc', description = "Unfiltered \" (double quotation mark). An indication of potential XSS vulnerability." },
{ vector = 'zxc\'xcv', description = "Unfiltered ' (apostrophe). An indication of potential XSS vulnerability." },
}
-- Create customized requests for all of our payloads.
local makeRequests = function(host, port, submission, fields, fieldvalues)
local postdata = {}
for _, p in ipairs(payloads) do
for __, field in ipairs(fields) do
if field["type"] == "text" or field["type"] == "textarea" or field["type"] == "radio" or field["type"] == "checkbox" then
local value = fieldvalues[field["name"]]
if value == nil then
value = p.vector
end
postdata[field["name"]] = value
end
end
stdnse.debug2("Making a POST request to " .. submission .. ": ")
for i, content in pairs(postdata) do
stdnse.debug2(i .. ": " .. content)
end
local response = http.post(host, port, submission, { no_cache = true }, nil, postdata)
end
end
local checkPayload = function(body, p)
if (body:match(p)) then
return true
end
end
-- Check if the payloads were successful by checking the content of pages in the uploadspaths array.
local checkRequests = function(body, target)
local output = {}
for _, p in ipairs(payloads) do
if checkPayload(body, p.vector) then
local report = " Payload: " .. p.vector .. "\n\t Uploaded on: " .. target
if p.description then
report = report .. "\n\t Description: " .. p.description
end
table.insert(output, report)
end
end
return output
end
local readFromFile = function(filename)
local database = { }
for l in io.lines(filename) do
table.insert(payloads, { vector = l })
end
end
action = function(host, port)
local formpaths = stdnse.get_script_args("http-stored-xss.formpaths")
local uploadspaths = stdnse.get_script_args("http-stored-xss.uploadspaths")
local fieldvalues = stdnse.get_script_args("http-stored-xss.fieldvalues") or {}
local dbfile = stdnse.get_script_args("http-stored-xss.dbfile")
if dbfile then
readFromFile(dbfile)
end
local returntable = {}
local result
local crawler = httpspider.Crawler:new( host, port, '/', { scriptname = SCRIPT_NAME, no_cache = true } )
if (not(crawler)) then
return
end
crawler:set_timeout(10000)
local index, k, target, response
-- Phase 1. Crawls through the website and POSTs malicious payloads.
while (true) do
if formpaths then
k, target = next(formpaths, index)
if (k == nil) then
break
end
response = http.get(host, port, target, { no_cache = true })
target = host.name .. target
else
local status, r = crawler:crawl()
-- if the crawler fails it can be due to a number of different reasons
-- most of them are "legitimate" and should not be reason to abort
if ( not(status) ) then
if ( r.err ) then
return stdnse.format_output(false, r.reason)
else
break
end
end
target = tostring(r.url)
response = r.response
end
if response.body then
local forms = http.grab_forms(response.body)
for i, form in ipairs(forms) do
form = http.parse_form(form)
if form and form.action then
local action_absolute = string.find(form["action"], "https*://")
-- Determine the path where the form needs to be submitted.
local submission
if action_absolute then
submission = form["action"]
else
local path_cropped = string.match(target, "(.*/).*")
path_cropped = path_cropped and path_cropped or ""
submission = path_cropped..form["action"]
end
makeRequests(host, port, submission, form["fields"], fieldvalues)
end
end
end
if (index) then
index = index + 1
else
index = 1
end
end
local crawler = httpspider.Crawler:new( host, port, '/', { scriptname = SCRIPT_NAME } )
local index
-- Phase 2. Crawls through the website and searches for the special crafted strings that were POSTed before.
while true do
if uploadspaths then
k, target = next(uploadspaths, index)
if (k == nil) then
break
end
response = http.get(host, port, target)
else
local status, r = crawler:crawl()
-- if the crawler fails it can be due to a number of different reasons
-- most of them are "legitimate" and should not be reason to abort
if ( not(status) ) then
if ( r.err ) then
return stdnse.format_output(false, r.reason)
else
break
end
end
target = tostring(r.url)
response = r.response
end
if response.body then
result = checkRequests(response.body, target)
if next(result) then
table.insert(returntable, result)
end
end
if (index) then
index = index + 1
else
index = 1
end
end
if next(returntable) then
table.insert(returntable, 1, "Found the following stored XSS vulnerabilities: ")
return returntable
else
return "Couldn't find any stored XSS vulnerabilities."
end
end
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.973 High
EPSS
Percentile
99.8%