Stored XSS Vulnerability

Complete Guidance of Store XSS (Finding & Reporting) 

Let’s start to understand the details of a stored cross-site scripting vulnerability. We are going to hear about the basic description of the vulnerability and how to search for it.

Introduction to Stored XSS ?

 

Stored XSS, also known as persistent XSS or type I XSS, is a web application vulnerability that allows an attacker to inject malicious code into a website that is permanently stored and displayed to other users. It is one of the most common types of cross-site scripting (XSS) attacks.

The consequences of stored XSS can be severe. When a user visits a page that serves the stored malicious script, the script can execute arbitrary code in their browser, potentially allowing an attacker to steal sensitive information, manipulate the content of the website, perform actions on behalf of the user, or even distribute malware.

In this Article :

•  How to Find stored XSS Vulnerability
•  Stored XSS Mitigation
•  Stored XSS Impact
•  Reporting Stored XSS Vulnerability

Impact :

Stored XSS can be used as an entry point to deliver and propagate malware to unsuspecting users. This can lead to widespread infections, compromised systems, and potential damage to data and resources.

Stored XSS can allow attackers to steal sensitive information from users, such as login credentials, personal data, or financial details, leading to potential identity theft or financial loss.

A successful stored XSS attack can lead to defacement or manipulation of website content, damaging the reputation and credibility of the affected organization. This can result in loss of user trust, decreased customer confidence, and negative publicity.

 

Mitigation of Stored XSS ? 

Preventing stored XSS attacks requires implementing various security measures throughout the web application development process. Here are some effective strategies to help mitigate the risk of stored XSS vulnerabilities:

1. Apply proper output encoding based on the context in which the user-generated content is displayed. Different contexts, such as HTML, JavaScript, or CSS, require specific encoding techniques to prevent script execution. Utilize libraries or frameworks that provide context-aware encoding functions.

2.  Follow secure coding practices, such as avoiding the use of eval() or the JavaScript "innerHTML" property, as these can inadvertently introduce XSS vulnerabilities. Use proper DOM manipulation methods and escape user-generated content appropriately.

3. Conduct regular security testing, such as vulnerability scanning and penetration testing, to identify and address XSS vulnerabilities. Perform thorough code reviews to detect any potential security flaws or insecure coding practices.

For More Information :

1. https://en.wikipedia.org/wiki/Web_application_firewall

How to Perform Stored XSS ? 

STEP #1: Visit any Websites, Create an Account & login .

STEP #2: Go to the edit profile options & Paste this payload in the First name Options                               <script>alert(document.cookie)</script>

STEP #3: Then save, You will get Cookies as a Popup .This Is a Stored XSS.

                         How to Report Vulnerability ?

Hello Team

                 I'm Career Technology Cyber Security India a white security researcher from Mumbai INDIA, founded a vulnerability on your website ie:https://www.exmple.com

Vulnerability Name: Stored XSS 

Descriptions:

XSS is an attack technique that injects malicious code into vulnerable web applications. Unlike other attacks, this technique does not target the web server itself, but the user's browser. Stored XSS is a type of XSS that stores malicious code on the application server.

Vulnerable URL:  https://www.exmple.com/store/customer/account/

Username : exmple@abc.com

Password : Exmple@123

Steps to Reproduce:

1. Visit the above URL

 2. Login the Account With Username and Password

 3. Click on my account options

 4. Go to the First Name and paste this payload

<script>alert(document.cookie)</script>

 5. you will get Cookie as a popup

 6. Please check the POC (Video) For More Information 

Impact of Stored XSS Attacks ?

1. Stored XSS attacks can lead to the compromise of user accounts on the affected website. By injecting malicious scripts, attackers can hijack user sessions, impersonate them, and perform unauthorized actions on their behalf. 

Solution to Avoid Stored XSS?

Encode user-generated or dynamic content properly before displaying it on web pages. This prevents the browser from interpreting the content as executable code. HTML entity encoding, such as converting "<" to "<" and ">" to ">", can be used to mitigate XSS vulnerabilities.

POC: Video & Screenshot

for more details you can ping me on mail

Thanks & Regard,

Career Technology Cyber Security India 

Indian Bug Hunter