Cross site scripting on goodmart.ind.in.

This project focuses on identifying a critical Cross-Site Scripting (XSS) vulnerability present on the e-commerce platform, Goodmart.ind.in. XSS vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users, potentially leading to data theft, session hijacking, and other security breaches. for more information visit: https://bostoninstituteofanalytics.org/cyber-security-and-ethical-hacking/

1. Cross site scripting on goodmart.ind.in Shahbaz Hussain – CNP-MAR2024-CSEH-1

2. Cross Site Scripting Cross-site scripting (XSS) is an attack in which an attacker injects malicious executable scripts into the code of a trusted application or website. Attackers often initiate an XSS attack by sending a malicious link to a user and enticing the user to click it. If the app or website lacks proper data sanitization, the malicious link executes the attacker’s chosen code on the user’s system. As a result, the attacker can steal the user’s active session cookie.

3. XSS vulnerability : Case study on Goodmart.ind website Site name: https://goodmart.ind.in/ Category : E-commerce Type : E-commerce website for Good mart Content : Information about different services provided by the good mart

4. Data Collection https://goodmart.ind.in/ website have currently using different following technologies CMS Adobe Experience Manger Analytics Adobe Analytics Programming Language Java Script HTML PHP

5. Impact Analysis Cross Site Scripting (XSS) is a vulnerability in a web application that allows a third party to execute a script in the user’s browser on behalf of the web application. Identify the Injection Point: Navigate the website and find a place where user input is reflected back into the HTML without proper sanitization. Inject Malicious Script: Craft a payload that includes the malicious script. This script will be executed when HTML is rendered. Test and Confirm: Ensure that the injected script executes correctly and achieves the intended malicious outcome.

6. Steps to Reproduce Go to the https://goodmart.ind.in/index.php First check that input is reflected into HTML code. In search bar enter any word and press search button then check the source code. After checking source code enter the malicious script into the input field. Hence, to exploit the I have used the payload : <script>alert(1)</script> By clicking the search button the alert pop up will occur.

7. Impact Data Theft Account Hijacking Client-Side Attacks Defacement of website

8. Proof of Concept During the testing of GoodMart website, cross site scripting vulnerability was found. The vulnerability allows as attacker to inject the malicious java script code into the input field, which could be executed in the context of user’s browser, potentially leading to session hijacking, sensitive data theft and other malicious actions. Vulnerability Details : Vulnerable URL : https://goodmart.ind.in/index.php Vulnerability Type : Cross Site Scripting (XSS) Affected Component : Search Input field Impact : HIGH

9. Mitigation Never trust user input: Always perform input validation and sanitization on input originating from untrusted sources as soon as you receive it Implement output encoding :  Output encoding escapes user input and ensures that the browser interprets it as benign data and not as code. HTML Sanitization : HTML Sanitization will strip dangerous HTML from a variable and return a safe string of HTML. Ensure that web application development aligns with  OWASP’s XSS Prevention Cheat Sheet : Cookie Attributes Content Security Policy  Web Application Firewalls Perform penetration testing to confirm re mediation was successful

10. REFRENCES https://portswigger.net/web-security/cross-site-scripting https://owasp.org/Top10/A03_2021-Injection/ https://labs.hackxpert.com/RXSS/ https://www.acunetix.com/websitesecurity/cross-site-scripting/

11. Thank You!