The first exercise in Gruyere in on cross site scripting or XXS. Cross-site scripting (XSS) is a vulnerability that permits an attacker to inject code (typically HTML or Javascript) into contents of a website not under the attacker's control. When a victim views such a page, the injected code executes in the victim's browser. Thus, the attacker has bypassed the browser's same origin policy and can steal victim's private information associated with the website in question.

In a reflected XSS attack, the attack is in the request itself (frequently the URL) and the vulnerability occurs when the server inserts the attack in the response verbatim or incorrectly escaped or sanitized. The victim triggers the attack by browsing to a malicious URL created by the attacker. In a stored XSS attack, the attacker stores the attack in the application (e.g., in a snippet) and the victim triggers the attack by browsing to a page on the server that renders the attack, by not properly escaping or sanitizing the stored data.  There are many venerable parts of the site, but the first feature that is exploited is the file upload. If a HTML file is uploaded with <script>alert(document.cookie);</script> as the content the script is executed and the users cookie information is displayed.

The next vulnerability that can be exploited is the URL. The site is designed to display an error if an invalid destination is entered. For example if you added ‘hello’ to the end of the url

http://google-gruyere.appspot.com/698806340929/hello

This page would be displayed.

Seeing that what you put into the url is being directly injected into the site is a good sign that there is a XXS vulnerability. So imputing the url

http://google-gruyere.appspot.com/698806340929/<script>alert(1)</script>

will run the malicious javascript.

As I continue through gruyere I will be leveraging the source code to find more vulnerabilities.