Simulate XSS attack - php

Question

I was trying to simulate the browser (and simulate XSS). Someone recommended me PhantomJS, however, I had some problems with executing simple JS commands.
I've created simple php website: xss.php
<form id = "myform" action="xss.php" method="POST">
<input id="x" name='x' type="text" />
<input type="submit" value="ok" />
</form>
<?php
echo $_POST['x'];
$fp = fopen("logs.txt", "a");
fwrite($fp, $_POST['x']);
fclose($fp);
?>
<script>document.getElementById('x').value='payload';
document.getElementById('myform').submit();</script>
When I run it from my browser, the form is sent (and its results its put into logs.txt. However, there is a problem, while trying to run that website via PhantomJS:
run.js:
var page = require('webpage').create();
var url = 'http://127.0.0.1/xss/xss.php';
page.open(url, function (status) {
if (status !== 'success') console.log('Network error');
else
{
var p = page.evaluate(function () {
});
console.log('DONE');
}
phantom.exit();
});
I run it via command line: ./phantomjs run.js
As far as I understand, this script should simulate the browser behavior and send the above form. However, there is nothing in logs.txt, which means, that phantomjs didn't run that script. Could you please tell me what I did wrong?

Answer 1

Your script puts the browser into an eternal loop, reloading the page xss.php. This will put the word 'payload' into logs.txt, until you stop javascript execution.
If you want to simulate form submition, you must explicitly send POST data to php script:
var page = require('webpage').create();
var url = 'http://127.0.0.1/xss/xss.php';
var data = 'x=phantom';
page.open(url, 'post', data, function (status) {
if (status !== 'success') console.log('Network error');
else
{
console.log('DONE');
}
phantom.exit();
});
This will feed POST data to xss.php, appending the word 'phantom' to logs.txt. But mind, that, unlike the browser, PhantomJS won't go into eternal loop and will send the request only once.