---
description: >-
  Hello guys I am back again. So let’s start talking rn bc I’m tired of
  everything.
---

# Intigriti  XSS Challenge May 2022

![](https://miro.medium.com/max/700/0*cioRESPcq3ygxZNU.png)

There’s always challenge description and yeah let’s access to the given URL.

![](https://miro.medium.com/max/700/0*omvR94r2Ya-gV5YM.png)

Hm main page is telling us something. Wait I know, maybe it’s giving us hint for prototype pollution. Let’s do source code analysis.

![](https://miro.medium.com/max/700/0*2Ey4rswUABCDPqaR.png)

So I saw there’s somewhere object called `pages.` An object is a collection of pairs that contain keys and their corresponding values. So, we can see that it gets the value of the page by the `page` parameter. And if the page value is in the `pages` object it will show the HTML content on the site. Also there's `filterXSS` function. Basically that function filters untrusted HTML content such as event handlers like onerror (">\<img src='x' onerror='alert(1)'>) etc. Everything we want to inject malicious, it will basically filter it out. But however maybe we can inject our own attribute inside the `pages` object. There are 3 external JS scripts used on the website. These are for jQuery, XSS and a jQuery plugin called query-object. If we take a look at them we will find out that the jQuery query-object plugin is vulnerable to prototype pollution. Now yeah we can confirm prototype pollution. I was right for that hint on main page. Here’s the link: [_https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/jquery-query-object.md_](https://github.com/BlackFan/client-side-prototype-pollution/blob/master/pp/jquery-query-object.md)_._

## So what is prototype pollution? <a href="#id-446c" id="id-446c"></a>

> _Prototype pollution is a vulnerability where an attacker is able to modify **Object.prototype**. Because nearly all objects in JavaScript are instances of Object, a typical object inherits properties (including methods) from **Object.prototype**. Changing **Object.prototype** can result in a wide range of issues, sometimes even resulting in RCE (Remote Code Execution)._
>
> _The most common way to cause prototype pollution is to use an unsafe merge or extend function to recursively copy properties from an untrusted source object._
>
> _Btw after some research I found this repo on github called_ [_client-side-prototype-pollution_](https://github.com/BlackFan/client-side-prototype-pollution)_. This repo is a collection of libraries which are vulnerable to prototype pollution. There’s some examples of useful script gadgets that can be used to demonstrate the impact._
>
> _The PoC for the jQuery query-object prototype pollution is to use the following request parameter: `?__proto__[test]=test`_
>
> _By using `__proto__` we can set our own attribute and a value for it. We can use this to inject HTML into to webpage._

![](https://miro.medium.com/max/700/0*IrSkl_lblJVghfQY.png)

So I injected code and payload works.

![](https://miro.medium.com/max/700/0*ph8RUQM4k9YyLv7d.png)

So what I did?

I used this page object (‘rootjkqsta’) instead of page number, and It is parsed into HTML. Now we need to bypass this HTML sanitizer.&#x20;



{% embed url="https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API" %}

Here's one quite interesting article about bypassing HTML sanitizer but not via prototype pollution by the way!

{% embed url="https://portswigger.net/research/bypassing-firefoxs-html-sanitizer-api" %}

And one important blog about bypassing HTML Sanitizer via prototype pollution:

{% embed url="https://research.securitum.com/prototype-pollution-and-bypassing-client-side-html-sanitizers/" %}

Let's give some examples how is this working

<mark style="color:purple;background-color:blue;">`<h1>Injection</h1>lulz<p>lol</p> <i>lool</i><script>alert(1)</script>`</mark>

In DOM it will become:

<mark style="color:blue;background-color:purple;">`<h1>Injection</h1>lulz<p>lol</p> lool`</mark>

This is example. It depends of web app's validator, in a nutshell it's a whitelist which allows some tags and attributes. Most of modern web app's today have strong whitelists, so it knows to be pretty hard to gain an XSS. HTML Sanitizer has strong whitelist by the way!

Example:

Let's try to insert some malicious JS code into HTML sanitizer:

<mark style="color:blue;">`sanitizeHtml('<img src=x onerror=alert(1)>')`</mark>

It will sanitize `onerror` event attribute and `alert()` function. I think you learned how HTML Sanitizer sanitizes malicious chars. But every modern web app has their own whitelist.

But if I pollute the prototype with:

<mark style="color:blue;">`Object.prototype['*'] = ['onerror']`</mark>

Then `onerror` will be a valid attribute to any tag:

<mark style="color:blue;">`sanitizeHtml('<img src=x onerror=alert(1)>')`</mark>

This is kinda short. Tho take a look at Michał Bentkowski's blog about this. There's everything explained. Now let's comeback to our challenge.&#x20;

## Bypass HTML sanitizer <a href="#id-6119" id="id-6119"></a>

We can try some payload such as (\<script>alert(1)\</script>) but we won’t get XSS because it is filtered out by the [xss module](https://www.npmjs.com/package/xss). But we can use prototype pollution to bypass it. The XSS module accepts a second parameter, called `options`. It has a prototype called `whiteList` which can be polluted. So, all we need to do is to define our own whitelist accepting `img` tag with `onerror` event handler and `src` attribute. We have defined the whitelist, now we can use the XSS payload: `<img src=x onerror=alert(document.domain)>` Btw don’t forget to URL encode the payload. This will be our final payload: `?__proto__[whiteList][img][0]=onerror&__proto__[whiteList][img][1]=src&__proto__[x]=<img%20src%3dx%20onerror%3dalert(document.domain)>&page=x`

![](https://miro.medium.com/max/700/0*gpmjYU-Y3lzo8401.png)

And that is it. We can confirm XSS.

## README.md <a href="#id-46b6" id="id-46b6"></a>

Hope you enjoy reading this writeup, hope you learn something new, take a care and see you in a next one writeup. Peace out.&#x20;
