Probe Contenteditable HTML Elements in the wild

This is the experiment for the first important pattern (trace) of html injection detailed in /home/jackfromeast/Desktop/TheHulk/docs/Empirical-Workflow-HTML-Injection-Detection.md. The contenteditable HTML elements is the prerequisite of html injection for the first pattern.

Luckily, we will find a list of webpages that contain HTML injection vulnerability, and importantly, a collection vulnerable dependency library (e.g. editor library).

Dataset & Enviorment Setup

In this experiment, we try to find the webpages that contain contenteditable html elements in the wild. We run the crawler on the following two datasets.

• Trenco Top 5K (Max URL: 500);

  • TheHulk/html-injection/probe-contenteditable/dataset/tranco-5k-05-03.csv

• Bug Bounty Program (Max URL: 200):

  • TheHulk/html-injection/probe-contenteditable/dataset/bug-bounty-domain.csv
  • contains 19459 domain

Approach

We run the crawler with the following callback action installed. Upon visiting each webpages, it go to every frames and find all the html elements with contenteditable attribute set. To filter out the false positives, it will exclude the input and textarea html tags.

TheHulk/html-injection/probe-contenteditable/paste-contenteditable-test-callbacks.js

Findings

On the Trench 5K Dataset

The raw crawl data has been placed in the following directory. It falls in five parts because if I run the experiment remotely, the server will stop after 7 hours running up.

• Statistics:

  • Number of unique domains: 249
  • Number of unique URL : 8446

• Raw Crawler Result:

  • /home/jackfromeast/Desktop/TheHulk/output/probe-contenteditable-top5k

• Summaried Result:

  • /home/jackfromeast/Desktop/TheHulk/html-injection/probe-contenteditable/results/top-5k-contenteditable-html-elements.json
  • /home/jackfromeast/Desktop/TheHulk/html-injection/probe-contenteditable/results/top-5k-contenteditable-html-elements.xlsx
  • https://docs.google.com/spreadsheets/d/1cV9cBptUaxBm9SrMsQDyQjb-2rsx6doOYV3khSyfXJg/edit?usp=sharing

On the Bug Bounty Program

When running expriment on the bug bounty program, we only explore 200 urls on each domain.

• Statistics:

  • Number of unique domains: 58
  • Number of unique URL : 1388

• Raw Crawler Result:

  • /home/jackfromeast/Desktop/TheHulk/output/probe-contenteditable-bug-bounty

• Summaried Result:

  • /home/jackfromeast/Desktop/TheHulk/html-injection/probe-contenteditable/results/bug-bounty-contenteditable-html-elements.json
  • /home/jackfromeast/Desktop/TheHulk/html-injection/probe-contenteditable/results/bug-bounty-contenteditable-html-elements.xlsx

Limitation

1. This experiment cannot find the HTML injection within the webpages that require login.

2. The crawler in this experiment cannot find the contenteditable HTML elements which need certain user interaction as prerequisite.