Technology sharing: How to Use File Upload to execute XSS?

Technology sharing: How to Use File Upload to execute XSS?

ExploitationFile UploadImplement XSS attacksIs a HackingThere are good opportunities for Web applications, especially in the case of ubiquitous upload of user portraits, which gives us many opportunities to discover developers' errors. Basic File Upload XSS attacks include.

1) file name

The file name itself may be part of a webpage that can cause reflection. Therefore, you can insert XSS statements into the file name to trigger reflection.

 

Although not intentionally, this XSS can be used in W3Schools.

2) Metadata

You can use the exiftool to modify the EXIF metadata, causing reflection in some places:

$ exiftool -FIELD=XSS FILE

Example:

$ exiftool -Artist=’ “>’ brute.jpeg

 

3) Content

If a Web application allows the upload of an SVG (an image type) extension, the following content can be used to trigger XSS:

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"/>

A poc can be seen here in brutelogic.com.br/poc.svg.

4) source code

We can easily create a GIF image containing javascript payload and reference it as the source code. If we can successfully inject the same domain name, as shown below, this can effectively help us bypass CSP (Content Security Policy) Protection (which cannot be executed for Example<script>alert(1)</script>)

 

To create such an image, you can use the following content and name the file as. gif Suffix:

GIF89a/*
  
   */=alert(document.domain)//;
  

The GIF File ID GIF89a is assigned to the alert function as a javascript variable. The XSS of the intermediate annotation is used to prevent the image from being retrieved as the text/html mime type, and the payload is executed by the request file.

We can find that both the PHP function exif_imagetype () and getimagesize () of UNIX Commands recognize this file as a GIF file. Generally, Web applications use these functions to verify the image type. Therefore, such a file can be uploaded (but it may be scanned and killed by anti-virus software ).