Thread by @harshbothra_

#learn365 Day-7: Cross-Site Script Inclusion (XSSI)
- XSS & XSSI are differemt.
In XSS, the payload is included on the victim to perform an action. However, In the case of XSSI, the victim's code (JS) is embedded in the attacker-controlled page.

#BugBountyTips #infosec (1/n)

(2/n)
In XSSI, the goal is to usually steal the data bypassing the restrictions such as the Same Origin Policy (SOP).
XSSI is less utilized and I never paid much attention to this attack vector. This seems to be an interesting and realistic, easy to exploit attack vector.

(3/n)
This attack is to mainly target the sensitive information that might get dynamically stored in the javascript files when a user performs some activity. If there are not proper restrictions set, an attacker can easily read and get hold of sensitive information.

(4/n)
However, this can also be utilized to steal other information such as authentication tokens.
There are mainly Four Situations when it comes to XSSI attack:
1. Regular XSSI (Static JS)
2. Authenticated Access to Static JS
3. Dynamic Javascript
4. Non-Script Attack

(5/n)
1. Regular XSSI - Static Javascript
- This is similar to looking for the hardcoded data in a javascript file.
- Since the javascript file is static, an attacker can try to embed it on a page in order to extract information.

This is the most common and easiest way.

(6/n)
2. Authenticated Access to Static JS or Dynamic JS
- In the case of Dynamic JS, the sensitive information is added to the Javascript file when the user performs an action.
- In the case of Authenticated Static JS, it requires an attacker to be authenticated.

(7/n)
- Testing Steps:
1. Perform an action with an authenticated user.
2. Perform the same action with the unauthenticated user.
3. Compare the content of JS files included in the response in both cases. If there is a difference it may give an idea of dynamic JS being used.

(8/n)
To Automatically detect this attack:
1. Use Detect DynamicJS Burp Plugin
2. It Passively scans all JS files & then scanning those files without auth identifier like cookies.
3. If the issue is found, it will be seen under Target Tab as an Informational severity finding.

(9/n)
Some Interesting Attacks as Described in OTG:
1. Sensitive Data Leakage via Global Variables
2. Leakage via Global Function Parameters
3. Leakage via CSV with Quotations Theft
4. Leakage via JavaScript Runtime Errors
5. Leakage via Prototype Chaining Using this

(n/n)
Reads & References
1. scip.ch/en/?labs.20160…
2. sebastian-lekies.de/leak/
3. owasp.org/www-project-we…
4. mbsd.jp/Whitepaper/xss…
5. medium.com/bugbountywrite…
6. usenix.org/system/files/c…

Labs
- google-gruyere.appspot.com/part3

Tools
- github.com/luh2/DetectDyn…