XSS — skript inksiyasi

innerHTML orqali kod bajarish

Dars 01 Jiddiy o'z saytingizda

Maqsad

bu darsda nimaga erishamiz

Foydalanuvchi kiritgan ma'lumot innerHTML ga qo'yilsa, uni JavaScript kodi sifatida bajarish mumkin. Natija — hujumchi foydalanuvchi yoki admin brauzerida kod bajaradi.

Nima mumkin bo'ladi	Oqibat
Cookie/session o'g'irlash	Admin hisobiga kirish
Parol maydoniga yozish	Admin parolini almashtirish
Tugmalarni bosish	Fayl o'chirish, rol berish
Keylogger	Barcha kiritilgan ma'lumot

Tushuntirish

3 ta turi

Tur	Qayerda	Xavf
Reflected	URL yoki form javobida qaytadi	O'rta
Stored	Ma'lumot bazaga saqlanadi	Yuqori
DOM	JS orqali (location.hash)	Yuqori

Asosiy mexanizm

// XAVFLI
el.innerHTML = `<h1>Salom ${req.query.name}</h1>`;
                       ↑ foydalanuvchi matni kod sifatida

// TO'G'RI
el.textContent = `Salom ${req.query.name}`;    // matn — kod emas

Muhim farq

innerHTML — HTML va kodni qabul qiladi. textContent — faqat oddiy matn qilib yozadi, hech narsa bajarilmaydi. Birinchi xato — ikkinchisi xavfsiz.

Qanday aniqlanadi

avval joy topamiz

1. Kodda izlang — qaysi joylarda foydalanuvchi matni innerHTML ga tushadi:

# Linux / macOS
grep -rnE "innerHTML" --include=*.js . | grep -v escapeHtml | grep '\$\{'
grep -rnE "insertAdjacentHTML|outerHTML\s*=" --include=*.js .

# Windows PowerShell
rg "innerHTML" -g "*.js" | Select-String -NotMatch "escapeHtml"

# Windows CMD (findstr)
findstr /S /N /C:"innerHTML" *.js | findstr /V "escapeHtml"

2. Kirish nuqtalarini toping — qaysi parametrlar foydalanuvchidan keladi:

location.search | location.hash | document.referrer
form input | textarea | URL parametr | fayl nomi | izoh
localStorage | cookie | API javobi | boshqa foydalanuvchi matni

3. Sinov paytini to'ldiring — barcha maxfiy maydonlarga shu skriptni qo'ying:

<img src=x onerror="alert(document.cookie)">
<script>alert(document.domain)</script>
" onmouseover="alert(1)" x="
<svg onload=alert(1)>
javascript:alert(1)

Buyruqlar

terminal orqali sinash

# 1) Reflekted XSS — URL orqali
curl -s "https://site.uz/search?q=<img src=x onerror=alert(1)>" | grep -i "onerror"

# 2) xatolik sahifasi (ko'pincha XSS chiqadi)
curl -s "https://site.uz/?q=<script>alert(1)</script>" | grep -iE "script|alert"

# 3) JSON API da (content-type e'tiborsiz bo'lsa)
curl -s "https://site.uz/api/search?q=<img src=x onerror=alert(1)>" | head -c 200

# 4) header orqali (ba'zi saytlar qaytaradi)
curl -s -D- -o /dev/null -H "X-Forwarded-For: <script>alert(1)</script>" \
  https://site.uz/ | grep -i "x-forwarded"

# 5) saqlangan XSS — izoh/mavzu yuborish
curl -s -X POST -H 'Content-Type: application/json' \
  -d '{"title":"<img src=x onerror=alert(document.cookie)>","body":"test"}' \
  https://site.uz/api/posts
# keyin boshqa foydalanuvchi ko'rganda alert chiqadi

REM 1) Reflekted XSS
curl -s "https://site.uz/search?q=%%3Cimg%%20src=x%%20onerror=alert(1)%%3E" | findstr /I "onerror"

REM 2) xatolik sahifasi
curl -s "https://site.uz/?q=%%3Cscript%%3Ealert(1)%%3C/script%%3E" | findstr /I "script alert"

REM PowerShell variant
$r = Invoke-WebRequest "https://site.uz/search?q="
$r.Content | Select-String "onerror"

REM 3) saqlangan XSS
Invoke-RestMethod -Uri "https://site.uz/api/posts" -Method Post \
  -ContentType 'application/json' \
  -Body '{"title":"","body":"t"}'

# Hamma platformada bir xil — faqat URL kodlash
# %3C = <   %3E = >   %20 = bo'shliq
curl -s "https://site.uz/?q=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E" | grep -i onerror

# brauzer konsolida (eng oson usul)
location.hash = ''
history.replaceState(null,'','#')

Natija

qanday javob = muvaffaqiyat

✓ MUvaffaqiyat — hujum ISHLADI

Server javobi	Nima degani
`<img src=x onerror=...>` qaytadi	XSS bor — matn escape qilinmagan
`<script>` brauzerda ishlaydi (alert)	Stored/Reflected XSS tasdiqlandi
`onerror=` atributi HTML da saqlanadi	atribut buzilishi — zaif atribut
`javascript:` sxemasi ishlatilmoqda	DOM XSS — kod bajariladi

✗ Rad etish — hujum ISHLAMADI

Server javobi	Nima degani
`<` → `&lt;` ko'rinadi	XSS yo'q — to'g'ri escape qilingan
`onerror` so'zi `<code>` ichida	XSS yo'q — matn sifatida chiqdi
`javob 400/422 (validatsiya)`	Server rad etdi — kirish nazorati bor
`Content-Type: application/json`	XSS yo'q — JSON brauzerda bajarilmaydi

Zararni yopish

3 ta qatlam

1. Frontend — escape

function escapeHtml(str) {
  return String(str ?? '').replace(/[&<>"']/g, m => ({
    '&':'&amp;', '<':'&lt;', '>':'&gt;', '"':'&quot;', "'":'&#39;'
  })[m]);
}
el.innerHTML = escapeHtml(userName);
// yoki oddiyroq va xavfsizroq:
el.textContent = userName;

2. Backend — chiqishda tozalash

const { sanitizeText } = require('../utils/sanitize');
res.json({ bio: sanitizeText(req.body.bio) });   // HTML teglarini olib tashlaydi

3. CSP sarlavhasi — chuqur himoya

Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'

✅ 3 qatlam birga

Escape + sanitizatsiya + CSP. Bittasi yetarli emas — escape xatosi bo'lsa CSP ikkinchi qatlam bo'lib qoladi.

Tekshirish ro'yxati

o'z saytingizda o'tkazing

Barcha `innerHTML` joylari `escapeHtml` yoki `textContent` bilan
Foydalanuvchi matni hech qayerda `