Friday, March 27th, 2009
XSS Rays: Scan pages for XSS holes
Category: Security
The code works by creating connections to the target links/paths using iframes, each iframe is assign a name which is the url to return to on successful execution (the originating url). This allows cross domain links to be checked.
The vectors are stored in a simple object, each vector has the following properties:- input, name, browser, form, url, path (there’s a optional second input). Input is the XSS vector, the string “XSS” is used to replace with a logger or a poc url and is required by all vectors.
Name is just a meaningful name applied to the vector, browser supports ALL|FF|IE and helps to save time when testing specific browser vectors as XSS Rays will only target those versions for the vector.
Gareth also shows how he enables the onload event of a dynamic iframe in a way that works with IE:
-
-
var ieLoader = "document.getElementById('"+'ray'+self.uniqueID+"').ieonload()";
-
if(self.isIE()) {
-
try {
-
var iframe = document.createElement('<iframe name="'+location + '#xss'+'" onload="'+ieLoader+'">');
-
} catch (e) {
-
var iframe = document.createElement('iframe');
-
}
-
} else {
-
var iframe = document.createElement('iframe');
-
}
-
Related Content:
Thanks for this useful article. It helped me out.