Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
</XSS>: The 3 Letter Monster<br />Nishant Das Patnaik<br />Venue: PayPal<br />4th December 2010<br />
~# whoami<br />Security Analyst, eBay IPC<br />Author, Software Hacking (with AnkitFadia)<br />Guest Columnist, The Times ...
./agenda<br />./scenario: The scene so far<br />./details: What is XSS?<br />./impact: What can XSS do?<br />./victims: Wh...
./scenario<br />
./details<br />What is XSS? <br />XSS is NOT  a vulnerability! It's an attack, an injection attack. <br />The strcpy() of ...
Persistent (Recurring; Less Common; More Dangerous)
DOM Based (Local; Rare)</li></li></ul><li>./impact<br /><ul><li>Change your University website to a porn megastore.
Can make me your girlfriend’s boyfriend!
Order 1000 pizzas for you!
Can fetch me your Credit Card number.
Take a snap of your bedroom.
Download Google.com’s Source Code
 … anything else I missed? ;)</li></li></ul><li>./victims<br />… anybody I missed? ;)<br />
Upcoming SlideShare
Loading in …5
×

XSS: The 3 Letter Monster

1,660 views

Published on

I presented this at BarCamp 5 at PayPal Office Chennai.

Published in: Technology
  • Do I have an option to save a copy, a big fan of your works. I just want to keep myself informed ;)
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • Be the first to like this

XSS: The 3 Letter Monster

  1. 1. </XSS>: The 3 Letter Monster<br />Nishant Das Patnaik<br />Venue: PayPal<br />4th December 2010<br />
  2. 2. ~# whoami<br />Security Analyst, eBay IPC<br />Author, Software Hacking (with AnkitFadia)<br />Guest Columnist, The Times of India; The Telegraph<br />Researcher, ClubHack; NullCon<br />Core Developer, SHANK (Portable Multi-Boot Security OS)<br />President, N.E.H.A.<br />Cyber Espionage Specialist<br />Contributing Member, CorelanTeam; IHP<br />Trained 3000+ Students, Professionals on Security Audit<br />… a fun-loving guy who lives down the lane!<br />
  3. 3. ./agenda<br />./scenario: The scene so far<br />./details: What is XSS?<br />./impact: What can XSS do?<br />./victims: Who are suffering?<br />./targets: Who are being exploited?<br />./entrypoints: Where does XSS live?<br />./detection: How to find XSS?<br />./protection: How to protect from XSS?<br />./resources: Where to learn more?<br /> Q & A<br />
  4. 4. ./scenario<br />
  5. 5. ./details<br />What is XSS? <br />XSS is NOT a vulnerability! It's an attack, an injection attack. <br />The strcpy() of Web! <br />Exploits your trust on the site.<br />Types: <br /><ul><li>Reflected (One Time; More Common; Less Dangerous)
  6. 6. Persistent (Recurring; Less Common; More Dangerous)
  7. 7. DOM Based (Local; Rare)</li></li></ul><li>./impact<br /><ul><li>Change your University website to a porn megastore.
  8. 8. Can make me your girlfriend’s boyfriend!
  9. 9. Order 1000 pizzas for you!
  10. 10. Can fetch me your Credit Card number.
  11. 11. Take a snap of your bedroom.
  12. 12. Download Google.com’s Source Code
  13. 13. … anything else I missed? ;)</li></li></ul><li>./victims<br />… anybody I missed? ;)<br />
  14. 14. ./targets<br />YOU!<br />
  15. 15. … anything I missed?<br />./entrypoints<br />
  16. 16. ./detection<br />Manual<br />“><script>prompt(11)</script><br /><object data=“javascript:prompt(1)”><br /><imgsrc=x:alert(alt) onerror=eval(src) alt=123><br />Automated<br />Skipfish<br />Ratproxy<br />W3AF<br />Burp Suite<br />WebScarab<br />WebSecurify<br />XSSF<br />XSS Me<br />
  17. 17. ./protection<br />End Users<br /><ul><li> IE8 XSS Filter
  18. 18. NoScript
  19. 19. Chrome XSS Filter
  20. 20. Make a Hacker friend and stay informed!</li></ul>Developers<br /><ul><li> Microsoft Anti-XSS (.NET)
  21. 21. OWASPAntiSamy (Java, .NET)
  22. 22. HTMLPurifier (PHP)
  23. 23. OWASP ReFormer (Various)
  24. 24. PHPIDS (PHP)
  25. 25. mod_security (Apache)
  26. 26. Make a Hacker friend and stay informed!</li></li></ul><li>./resources<br />OWASP: http://www.owasp.org<br />RSnake's: http://ha.ckers.org/xss.html<br />Slackers Forum: http://sla.ckers.org<br />Google: http://google-gruyere.appspot.com<br />WASC: http://www.webappsec.org<br />
  27. 27. ./thankyou<br />Questions?<br />Google “Nishant Das Patnaik”<br />@dpnishant<br />facebook.com/nishant.dp<br />youtube.com/nishantdp<br />in.linkedin.com/in/nishantdaspatnaik<br />

×