How to Tackle Web Security Assignments Involving SQLi, XSS, and CSRF Attacks

A successful injection may cause errors or reveal extra database rows, giving clues about the underlying query structure. Slowly escalate your injection strategy to extract database schema, table contents, and eventually perform unauthorized actions like creating accounts or changing cookies.

Cross-Site Scripting (XSS): Stealing Data through JavaScript

XSS challenges typically ask you to inject JavaScript that runs in another user's browser. The idea is to find input fields that render HTML unsanitized. For example, if a user bio or nickname field renders:

It’s vulnerable. In more advanced cases, your payload might need to extract cookies or DOM data:

This can be made persistent if it’s stored in user profiles.

Cross-Site Request Forgery (CSRF): Performing Actions on Behalf of Others

In CSRF tasks, you craft HTML that triggers authenticated actions (like updating a grade or uploading an image) without the user’s consent. For instance:

This kind of payload runs automatically when the victim opens your malicious HTML file.

Step-by-Step Approach to Solving Security-Centric Web Assignments

1. Setting Up Your Environment the Right Way

a. Understanding Docker and the Grading Setup

Most assignments, like EECS 388’s, require you to work within Docker to simulate the target web environment. Begin by following the provided setup guide and make sure the testing site (e.g., https://umich.eu) is accessible. Only work within authorized containers.

Also, install the same browser version used by the autograder (often Chrome) to ensure consistency in DOM rendering and scripting behavior.

b. Using Browser DevTools Like a Pro

Chrome DevTools is your command center:

• Console Tab: Write test scripts and observe error messages.
• Network Tab: Track GET/POST requests, check parameters, and inspect cookies.
• Elements Tab: Explore HTML structure and IDs—important for constructing precise exploits.

c. Safeguarding Your Work and Submissions

Keep a backup of each submission. Use version control (like Git) even if not required. Label scripts with clear filenames (sql_1.txt, xss_2.txt) and keep code readable with comments. The autograder checks for specific formatting, so always match HTML element IDs exactly as shown in the source.

2. Solving SQL Injection Challenges with Surgical Precision

a. Triggering Errors and Exposing Database Details

Your first task is usually to generate a 500 Internal Server Error. This confirms the input reaches the SQL interpreter. Use a payload like:

If it throws an error, escalate by trying a union-based attack:

' UNION SELECT sql FROM sqlite_master --

This reveals table schemas—an important step in formulating deeper attacks.

b. Cookie Manipulation to Gain Unauthorized Access

Most sites use cookies to manage session state. If you’re given an auth cookie, try modifying it to mimic a logged-in user. Use tools like EditThisCookie to inject your custom value. You might guess or brute-force values based on patterns observed in other cookies.

Example:

If accepted, this opens the door for deeper privilege escalation.

3. Mastering XSS Exploits in Profile-Based Web Apps

Understanding Where and How Scripts Execute

a. Testing the “About Me” Section for Persistent XSS

Start simple. Insert:

If it executes on profile load, escalate to a data exfiltration payload:

This kind of payload silently sends stolen data when a user visits the profile.

b. Evading Filters in “Also Known As” Fields

More protected fields might sanitize tags. Try bypass techniques:

• Using <svg onload=...> instead of <script>
• Using character encoding like <script>

If you know the filter regex (like in this case), reverse-engineer it to inject safe-looking tags that still run code.

c. Creating Worms That Spread Automatically

This task simulates the famous Samy worm. Write a payload that appends text and reinjects itself into profiles:

This auto-propagates across profiles.

4. Cracking CSRF Attacks Through Creative HTML Engineering

a. Executing Actions Without User Consent

Uploading Files with Pre-filled URLs

CSRF attacks are strongest when they require no user interaction. You can often get away with submitting forms via an image, iframe, or auto-submitting script.

Example:

Test that the image appears with the correct username label.

b. Manipulating Grade Submissions from Instructor View

To update grades using CSRF, target the GET endpoint used by instructors:

<img src="https://gradebook.umich.eu/update?id=1&score=100" />

This runs immediately on page load if the instructor is logged in, provided the app doesn’t enforce CSRF tokens or origin checks.

Key Tips for Efficiency and Accuracy

1. Reuse and Modify Payloads Strategically

Don't reinvent the wheel. Once you find a payload that works in one context, try it in another. Slight tweaks can adjust the same XSS payload from “About Me” to “Also Known As.”

2. Understand Server Behavior

If the server hashes passwords or escapes strings, study its logic. For instance, if passwords are hashed using sha256("mungle-" + password), try precomputing hashes using a Python script before submitting login attempts.

3. Watch for Client-Side Filtering and Server-Side Loopholes

What you see in the form might be cleaned in JavaScript, but sent raw to the server. Always inspect what actually reaches the server using DevTools' Network tab.

Conclusion

Web security assignments like EECS 388 Project 2 go beyond theoretical attacks—they immerse you in hands-on, real-world exploitation in a safe and ethical environment. Whether it's crafting a worm that self-replicates, injecting SQL through poorly sanitized forms, or executing actions on behalf of logged-in users, each task demands a blend of creative problem-solving and technical precision.

By mastering tools like DevTools, understanding cookie-based session handling, and writing stealthy JavaScript payloads, you’ll not only ace these assignments but also become a more security-conscious developer.