SC 201: XSS (25 pts)

What You Need

Making an HTML Form

On your cloud Linux server, execute this command: 
sudo nano /var/www/html/SC201.htm
Paste in this code, as shown below. 
<html>
<body>
<form action="SC201.php">
    Name: <input name="name"><p>
    <input type="submit" value="Submit">
</form>
</body>
</html>
Save the file with Ctrl+X, Y, Enter.

Making a PHP Script

On your cloud Linux server, execute this command: 
sudo nano /var/www/html/SC201.php
Paste in this code, as shown below. 
<?php

if (!isset($_REQUEST['name'])) {
	die("<h2>Error: No name specified!</h2>");
}

$name = $_REQUEST['name'];
print("Hello, $name!");

?>
Save the file with Ctrl+X, Y, Enter.

Testing your Form

In a Web browser, open this URL, replacing the IP address with the external IP of your server:
http://35.222.29.122/SC201.htm
Enter your name into the form, as shown below, and click the Submit button.

The next page should say Hello to you by name, as shown below.

In a Web browser, open this page:
https://samlols.samsclass.info/SC/SC201.htm
Enter the URL to your PHP page in the form for flag SC 201.1, as shown below, and click the Submit button.

Flag SC 201.1: Hello (5 pts)

The flag appears, as shown below.

Observing the XSS Vulnerability

In a Web browser, open this URL, replacing the IP address with the external IP of your server:
http://35.222.29.122/SC201.htm
Enter this name into the form:
<script>alert(1)</script>
as shown below, and click the Submit button.

The next page shows a pop-up box, as shown below.

This demonstrates a Cross-Site Scripting vulnerability--the user's name can be abused to inject script into the page.

Fix 1: Removing Characters

Modify your script to remove these characters from the name:
< >
I recommend using the str_replace function. Test your script on your own HTML form.

When it's working, run the test in the box below to get the flag.

Flag SC 201.2: Removing Characters (10 pts)

In a Web browser, open this page:

https://samlols.samsclass.info/SC/SC201.htm
Enter the URL to your PHP page in the form for flag SC 201.2 and submit the form. If your code is correct, the flag will appear.

Fix 2: HTML-Encoding

Modify your script to replace these characters in the name:
< >
with these HTML-encoded versions:
&lt; &gt;
When it's working, run the test in the box below to get the flag.

Flag SC 201.3: Encoding Characters (10 pts)

In a Web browser, open this page:

https://samlols.samsclass.info/SC/SC201.htm
Enter the URL to your PHP page in the form for flag SC 201.3 and submit the form. If your code is correct, the flag will appear.

Posted 3-10-24