Easy DOM-based XSS detection via Regexes

If you are interested in finding DOM-based XSS, you must have knowledge of http://code.google.com/p/domxsswiki/wiki/Introduction already. this is the best online resource about DOM-based XSS maintained by my friends Stefano di Paola and Mario Heiderich.

The wiki contains a deep explanation:

• All the potential sinks likeLocation,Cookie,CSS,Eval-Like calletc ..
• The quirks between browsers regarding which characters are escaped in various locations such as after the hash fragment, location, path etc ..
• A participant focus on jQuery sinks like.Wrap,.Prepend,.GloablEvalAnd so on ..
• Last but not least, 2 regexes that help identifying source and sinks.

You know, I like to automate as much as possible during my day-to-day pentesting hacktivities, so I wrote a very basic Ruby script that applies the regexes created by Mario for you. if you was expecting a Python or Perl Script, don't bother to read the rest of the article:-D

Please CT a second blog post in a few months about the integration of these regexes in Burp Pro. dafydd now added support to instrument IBurpExtender directly from Ruby using JRuby, so this code can be easily added directly inside Burp, in order to be applied inline on every HTTP response.

require "net/http"require "net/https"require "uri" MAIN_URL = 'https://target.com'MAIN_DOMAIN = 'target.com'PORT = 443 # from Burp, use "copy URLs in this branch", and replace the following array content accrodingly.PATHS_TO_TEST = [ '/dir/file/file1.js','/dir/file/file2.js','/dir/file/file3.js','/dir/file/file4.js','/dir/file/file5.js','/dir/file/file6.js'] puts "[+] starting requests to #{MAIN_URL}"    PATHS_TO_TEST.each{|path|      p "==================================== Analyzing [#{path}] ===================================="      url = URI.parse(MAIN_URL + ':' + PORT.to_s + path)      http = Net::HTTP.new(url.host, url.port)      if url.scheme == "https"          http.use_ssl = true          http.verify_mode = OpenSSL::SSL::VERIFY_NONE # don't bother checking for valid SSL certificates.      end      req = Net::HTTP::Get.new(url.path)      http.request(req) do |res|         line = 1         response = res.body.to_s.split("\n")           response.each{|i|             # apply DOM-based xss regex to each HTTP response line, printing out lineNumber and lineContent             # that would potentially be vulnerable to DOM-based XSS             # Potential sinks and sources are enumerated here.             if(i.scan(/((src|href|data|location|code|value|action)\s*["'\]]*\s*\+?\s*=)|((replace|assign|navigate|getResponseHeader|open(Dialog)?|showModalDialog|eval|evaluate|execCommand|execScript|setTimeout|setInterval)\s*["'\]]*\s*\()/).size > 0 ||                i.scan(/(location\s*[\[.])|([.\[]\s*["']?\s*(arguments|dialogArguments|innerHTML|write(ln)?|open(Dialog)?|showModalDialog|cookie|URL|documentURI|baseURI|referrer|name|opener|parent|top|content|self|frames)\W)|(localStorage|sessionStorage|Database)/).size > 0)              p "[#{path}]-#{line}: #{i}"             end             line += 1           }      end    }

 

To use the Ruby script, right click on a resource branch in Burp's SiteMap (the one which contains JavaScript files) and copy them to a file. remove every line that is not ending. js, because Burp also exports URLs which are just folders.

Now simply modifyPATHS_TO_TESTArray with these URLs, adjustMAIN_URL,MAIN_DOMAINAndPORTAccordingly to your target, and run the script. All the resources you want to analyze are downloaded and the regexes are run on the HTTP response contents.

The output will be something like:

"==================================== Analyzing [/xxx/script/PaymentAttemptList.js] ====================================""[/xxx/script/PaymentAttemptList.js]-107:         oField.src = \"/xxx/pictures/expand.gif\";""[/xxx/script/PaymentAttemptList.js]-110:         oField.src = \"/xxx/pictures/collapse.gif\";""[/xxx/script/PaymentAttemptList.js]-124:                 if ( oResponse ) { eval(oResponse); }"

"==================================== Analyzing [/xxx/script/sort/TableSorter.class.js] ====================================""[/xxx/script/sort/TableSorter.class.js]-126:     window.setTimeout(function ()""[/xxx/script/sort/TableSorter.class.js]-438:     var t = s.replace(/\\-/g, '/');""[/xxx/script/sort/TableSorter.class.js]-460:     var t = s.replace(/[^0-9\\.-]/g, \"\");"

As you can see, there are things which are false positives, for example the first two linesPaymentAttemptList. js:The variable assignments are static values.

Other things instead look interesting and deserve additional manual analysis, like whereEval,SetTimeout, OrReplaceAre used. the next step is opening all the JavaScript code in a proper IDE (if it's really complex ), go to the matched line and start manual analysis tracking back all the function cballs and variable assignments that lead to the sink.

Inline scripts are out of scope in this particle example. If you want to test a particle HTML page which contains a of lot of inline JavaScript code, just add its URI toPATHS_TO_TESTArray.

Bear in mind the script will not be very valid tive when processing minified JavaScript, because I'm not beautifying it before running the regexes. You're free to customise it with this additional feature.

I will probably play with the new Burp extender Ruby API soon, and eventually port this code as a Burp extension. in the meantime, if you want a tool that does proper dynamic data tainting, meaning it can determine the exact sink of a DOM-based XSS vulnerability, you should use Stefano's DOMinator Pro.

Stay tuned