Announcing Sleepy Puppy — Cross-Site Scripting Payload Management for Web Application Security Testing
by Scott Behrens and Patrick Kelley
Netflix is pleased to announce the open source release of our cross-site scripting (XSS) payload management framework: Sleepy Puppy!
The Challenge of Cross-Site Scripting
Cross-site scripting is a type of web application security vulnerability that allows an attacker to execute arbitrary client-side script in a victim’s browser. XSS has been listed on the OWASP Top 10 vulnerability list since 2004, and developers continue to struggle with mitigating controls to prevent XSS (e.g. content security policy, input validation, output encoding). According to a recent report from WhiteHat Security, a web application is 47% likely to have one or more cross-site scripting vulnerabilities.
A number of tools are available to identify cross-site scripting issues; however, security engineers are still challenged to fully cover the scope of applications in their portfolio. Automated scans and other security controls provide a base level of coverage, but often only focus on the target application.
Delayed XSS Testing
Delayed XSS testing is a variant of stored XSS testing that can be used to extend the scope of coverage beyond the immediate application being tested. With delayed XSS testing, security engineers inject an XSS payload on one application that may get reflected back in a separate application with a different origin. Let’s examine the following diagram.
Here we see a security engineer inject an XSS payload into the assessment target (App #1 Server) that does not result in an XSS vulnerability. However, that payload was stored in a database (DB) and reflected back in a second application not accessible to the tester. Even though the tester can’t access the vulnerable application, the vulnerability could still be used to take advantage of the user. In fact, these types of vulnerabilities can be even more dangerous than standard XSS since the potential victims are likely to be privileged types of users (employees, administrators, etc.)
To discover the triggering of a delayed XSS attack, the payload must alert the tester of App #2’s vulnerability in a different manner.
Toward Better Delayed XSS Payload Management
A number of talks and tools cover XSS testing, with some focussing on the delayed variant. Tools like BEef, PortSwigger BurpSuite Collaborator, and XSS.IO are appropriate for a number of situations and can be beneficial tools in the application security engineer’s portfolio. However, we wanted a more comprehensive XSS testing framework to simplify XSS propagation and identification and allow us to work with developers to remediate issues faster.
Without further ado, meet Sleepy Puppy!
Sleepy Puppy
Sleepy Puppy is a XSS payload management framework that enables security engineers to simplify the process of capturing, managing, and tracking XSS propagation over long periods of time and numerous assessments.
We will use the following terminology throughout the rest of the discussion:
- Assessments describe specific testing sessions and allow the user to optionally receive email notifications when XSS issues are identified for those assessments.
- Payloads are XSS strings to be executed and can include the full range of XSS injection.
- PuppyScripts are typically written in JavaScript and provide a way to collect information on where the payload executed.
- Captures are the screenshots and metadata collected by the default PuppyScript
- Generic Collector is an endpoint that allows you to optionally log additional data outside the scope of a traditional capture.
Sleepy Puppy is highly configurable, and you can create your own payloads and PuppyScripts as needed.
Security engineers can leverage the Sleepy Puppy assessment model to categorize payloads and subscribe to email notifications when delayed cross-site scripting events are triggered.
Sleepy Puppy also exposes an API for users who may want to develop plugins for scanners such as Burp or Zap. With Sleepy Puppy, our workflow of testing now looks like this:
Testing is straightforward as Sleepy Puppy ships with a number of payloads, PuppyScripts, and an assessment. To provide a better sense of how Sleepy Puppy works in action, let’s take a look at an assessment we created for the XSS Challenge web application, a sample application that allows users to practice XSS testing.
To test the XSS Challenge web app, we created an assessment named ‘XSS Game’, which is highlighted above. When you click and highlight an assessment, you can see a number of payloads associated with this assessment. These payloads were automatically configured to have unique identifiers to help you correlate which payloads within your assessment have executed. Throughout the course of testing, counts of captures, collections, and access log requests are provided to quickly identify which payloads are executing.
Simply copy any payload and inject it in the web application you are testing. Injecting Sleepy Puppy payloads in stored objects that may be reflected in other applications is highly recommended.
The default PuppyScript configured for payloads captures useful metadata including the URL, DOM with payload highlighting, user-agent, cookies, referer header, and a screenshot of the application where the payload executed. This provides the tester ample knowledge to identify the impacted application so they may mitigate the vulnerability quickly. As payloads propagate throughout a network, the tester can trace what applications the payload has executed in. For more advanced use cases, security engineers can chain PuppyScripts together and even leverage the generic collector model to capture arbitrary data from any input source.
After the payload executes, the tester will receive an email notification (if configured) and be presented with actionable data associated with the payload execution:
Here, the security engineer is able to view all of the information collected in Sleepy Puppy. The researcher is presented with when the payload fired, url, referrer, cookies, user agent, DOM, and a screenshot.
Architecture
Sleepy Puppy makes use of the following components :
- Python 2.7 with Flask (including a number of helper packages)
- SQLAlchemy with configurable backend storage
- Ace Javascript editor for editing PuppyScripts
- Html2Canvas JavaScript for screenshot capture
- Optional use of AWS Simple Email Service (SES) for email notifications and S3 for screenshot storage
We’re shipping Sleepy Puppy with built-in payloads, PuppyScripts and a default assessment.
Getting Started
Sleepy Puppy is available now on the Netflix Open Source site. You can try out Sleepy Puppy using Docker. Detailed instructions on setup and configuration are available on the wiki page.
Interested in Contributing?
Feel free to reach out or submit pull requests if there’s anything else you’re looking for. We hope you’ll find Sleepy Puppy as useful as we do!
Special Thanks
Thanks to Daniel Miessler for the extensive feedback after our Bay Area OWASP talk which was discussed in his blogpost:
Conclusion
Sleepy Puppy is helping the Netflix security team identify XSS propagation through a number of systems even when those systems aren’t assessed directly. We hope that the open source community can find new and interesting uses for Sleepy Puppy, and use it to simplify their XSS testing and improve remediation times. Sleepy puppy is available on our GitHub site now!
Originally published at techblog.netflix.com on August 31, 2015.
