[Tutorial] Cross Site Script/XSS

██╗  ██╗███████╗███████╗    ████████╗██╗   ██╗████████╗ ██████╗ ██████╗ ██╗ █████╗ ██╗
╚██╗██╔╝██╔════╝██╔════╝    ╚══██╔══╝██║   ██║╚══██╔══╝██╔═══██╗██╔══██╗██║██╔══██╗██║
 ╚███╔╝ ███████╗███████╗       ██║   ██║   ██║   ██║   ██║   ██║██████╔╝██║███████║██║
 ██╔██╗ ╚════██║╚════██║       ██║   ██║   ██║   ██║   ██║   ██║██╔══██╗██║██╔══██║██║
██╔╝ ██╗███████║███████║       ██║   ╚██████╔╝   ██║   ╚██████╔╝██║  ██║██║██║  ██║███████╗
╚═╝  ╚═╝╚══════╝╚══════╝       ╚═╝    ╚═════╝    ╚═╝    ╚═════╝ ╚═╝  ╚═╝╚═╝╚═╝  ╚═╝╚══════╝

██████████████████████████████████████████████████
╔╦╗┌─┐┌┐ ┬  ┌─┐  ┌─┐┌─┐  ╔═╗┌─┐┌┐┌┌┬┐┌─┐┌┐┌┌┬┐┌─┐
 ║ ├─┤├┴┐│  ├┤   │ │├┤   ║  │ ││││ │ ├┤ │││ │ └─┐
 ╩ ┴ ┴└─┘┴─┘└─┘  └─┘└    ╚═╝└─┘┘└┘ ┴ └─┘┘└┘ ┴ └─┘

 1.) [What is "XSS"?]
 2.) [Stored aka Non-Persistent]
 3.) [Reflected XSS aka Non-Persistent]
 4.) [DOM-BASED]
 5.) [Executing XSS]
 6.) [Finding XSS]

██████████████████████████████████████████████████
          ╔═╗╦═╗╔═╗╔╦╗╦╔╦╗
          ║  ╠╦╝║╣  ║║║ ║
          ╚═╝╩╚═╚═╝═╩╝╩ ╩

	http://twitter.com/urbackdoored

███████████████████████████████████████████████████
╦ ╦┬ ┬┌─┐┌┬┐  ┬┌─┐  ─┐ ┬┌─┐┌─┐┌─┐
║║║├─┤├─┤ │   │└─┐  ┌┴┬┘└─┐└─┐ ┌┘
╚╩╝┴ ┴┴ ┴ ┴   ┴└─┘  ┴ └─└─┘└─┘ o

What does "XSS" mean? It means "cross site scripting" | Using payloads you can execute in text boxes, url & even in the code itself.
XSS can be found in all kinds of code mostly including javascript & php. It also can be found in web browsers & apps.
With XSS you can steal cookie information, deface the website of its contents & redirect the website to malicious downloads
You can do many things with XSS. The amount of things you can do with it is unexplainable, People has found XSS in cars!
That's how bad this effects stuff. in this tutorial i will show you how to properly execute XSS on a web page.
There are many types of XSS methods, First i will explain what types there are.


████████████████████████████████████████████████████████████████████████████████████████████


╔═╗┌┬┐┌─┐┬─┐┌─┐┌┬┐  ┌─┐┬┌─┌─┐  ╔╗╔┌─┐┌┐┌   ┌─┐┌─┐┬─┐┌─┐┬┌─┐┌┬┐┌─┐┌┐┌┌┬┐
╚═╗ │ │ │├┬┘├┤  ││  ├─┤├┴┐├─┤  ║║║│ ││││───├─┘├┤ ├┬┘└─┐│└─┐ │ ├┤ │││ │
╚═╝ ┴ └─┘┴└─└─┘─┴┘  ┴ ┴┴ ┴┴ ┴  ╝╚╝└─┘┘└┘   ┴  └─┘┴└─└─┘┴└─┘ ┴ └─┘┘└┘ ┴

Stored XSS generally occurs when user input is stored on the target server,
such as in a database, in a message forum, visitor log, comment field,
etc. And then a victim is able to retrieve the stored data from the web application without that data being made safe to render in the browser.
With the advent of HTML5, and other browser technologies, we can envision the attack payload being permanently stored in the victim’s browser, such as an HTML5 database,
and never being sent to the server at all.


████████████████████████████████████████████████████████████████████████████████████████████

╦═╗┌─┐┌─┐┬  ┌─┐┌─┐┌┬┐┌─┐┌┬┐  ═╗ ╦╔═╗╔═╗  ┌─┐┬┌─┌─┐  ╔╗╔┌─┐┌┐┌   ╔═╗┌─┐┬─┐┌─┐┬┌─┐┌┬┐┌─┐┌┐┌┌┬┐
╠╦╝├┤ ├┤ │  ├┤ │   │ ├┤  ││  ╔╩╦╝╚═╗╚═╗  ├─┤├┴┐├─┤  ║║║│ ││││───╠═╝├┤ ├┬┘└─┐│└─┐ │ ├┤ │││ │
╩╚═└─┘└  ┴─┘└─┘└─┘ ┴ └─┘─┴┘  ╩ ╚═╚═╝╚═╝  ┴ ┴┴ ┴┴ ┴  ╝╚╝└─┘┘└┘   ╩  └─┘┴└─└─┘┴└─┘ ┴ └─┘┘└┘ ┴

Reflected XSS occurs when user input is immediately returned by a web application in an error message, search result,
or any other response that includes some or all of the input provided by the user as part of the request, without that data being made safe to render in the browser,
and without permanently storing the user provided data. In some cases, the user provided data may never even leave the browser (see DOM Based XSS next).


████████████████████████████████████████████████████████████████████████████████████████████


╔╦╗╔═╗╔╦╗   ╔╗ ╔═╗╔═╗╔═╗╔╦╗
 ║║║ ║║║║───╠╩╗╠═╣╚═╗║╣  ║║
═╩╝╚═╝╩ ╩   ╚═╝╩ ╩╚═╝╚═╝═╩╝
As defined by Amit Klein, who published the first article about this issue[1],
DOM Based XSS is a form of XSS where the entire tainted data flow from source to sink takes place in the browser,
i.e., the source of the data is in the DOM, the sink is also in the DOM, and the data flow never leaves the browser.
For example, the source (where malicious data is read) could be the URL of the page (e.g., document.location.href),
or it could be an element of the HTML, and the sink is a sensitive method call that causes the execution of the malicious data (e.g., document.write)."


████████████████████████████████████████████████████████████████████████████████████████████


╔═╗─┐ ┬┌─┐┌─┐┬ ┬┌┬┐┬┌┐┌┌─┐  ═╗ ╦╔═╗╔═╗
║╣ ┌┴┬┘├┤ │  │ │ │ │││││ ┬  ╔╩╦╝╚═╗╚═╗
╚═╝┴ └─└─┘└─┘└─┘ ┴ ┴┘└┘└─┘  ╩ ╚═╚═╝╚═╝

Your normal payload for a reflected XSS would be;

<script>alert("XSS")</script>

That little script, is HTML. It will make a little message pop up, saying "XSS". You can edit that part if you like.
Just don't edit any other parts of the script. Put that into your search bar, and hit enter.
Now, if a little alert box popped up, you've successfully attacked a site vulnerable to XSS!
If no box popped up, that is alright, because that means the site has taken some time to put in a filter.
A filter, is when we search something, then it goes through a mini process, basically an inspection.
It checks for any malicious (dangerous) things. In this case,
it will look for XSS. Sometimes, these filters are very weak, and can be by-passed very easily,
other times, they can be quite difficult to bypass. There are a lot of ways to bypass an XSS filter. First,
we have to find out what the filter is blocking. A lot of the time, it is blocking the alert. Here's an example of this kind of filter;

<script>alert( > XSS < )</script>


It will look like;

http://fbi.gov/fuckfeds.php?id=420<script>alert("XSS")</script>

or

http://fbi.gov/fuckfeds.php?id=420<script>alert( > XSS < )</script>


Note; This payload is harmless, You will need to learn more of XSS to start doing ideal stuff with it.


████████████████████████████████████████████████████████████████████████████████████████████


╔═╗┬┌┐┌┌┬┐┬┌┐┌┌─┐  ═╗ ╦╔═╗╔═╗
╠╣ ││││ │││││││ ┬  ╔╩╦╝╚═╗╚═╗
╚  ┴┘└┘─┴┘┴┘└┘└─┘  ╩ ╚═╚═╝╚═╝

Please do not use "google dorks" in-order to find XSS vulnerable websites,
There are plenty of "XSS scanners" that google has to offer, People develop
XSS scanners in many different languages including perl, python, vb, java,
php, ruby, & ps1.

Honestly I've found XSS in CNN, FoxNews, Esports, EA, AOL, Comcast, Verizon & Hack Forums
WITHOUT google dorks, For links to be crawled with google they will need to be of went to
numerous times. So yes you can use google dorks but it will not give you the best results.