Attacking Web Applications With JS Tap

Drew Kirkpatrick presents JSTap, an open-source tool for red teams that runs a JavaScript payload in a victim's browser after a cross-site scripting flaw or a server foothold. It attacks only the client side, instrumenting what a user does without touching the server. Two modes exist: implant mode, where the payload sits in the application's own scripts, and trap mode, which uses iframe traps for persistence and spoofs the address bar so the victim believes they are still on the expected page.

The first demo uses a WordPress site with a vulnerable reflected XSS plugin. A lure pushes a user to a login page, and JSTap logs cookies and storage values, scraped HTML, visited URLs, screenshots and keystrokes, including the credentials. Watching the victim add a second admin, the speaker recovers that account's generated password from the page source. A second demo targets a single-page app using XHR, fetch and jQuery. Because JavaScript lets code rewrite built-in APIs at runtime, the payload monkey-patches those network functions to capture request bodies, responses and an authentication token from local storage.

For defenders, the advice is to eliminate XSS and to enforce a strict Content Security Policy, particularly a connect-src directive that blocks exfiltration to unlisted servers. Same-origin framing policies stop clickjacking but not iframe traps; blocking all framing does.