Recommended
More Related Content
Viewers also liked
Viewers also liked (12)
Similar to Scrubbing Your AJAX
Similar to Scrubbing Your AJAX (20)
More from goodfriday
More from goodfriday (20)
Recently uploaded
Recently uploaded (20)
Scrubbing Your AJAX
- 2. What is Cross Site Scripting Cross Site Scripting (XSS) is a security exploit where malicious scripts are injected into the URL (query strings?) or form fields of a site and then run by unsuspecting victims. Reflected Stored Local
- 3. Hacker Persuades Victim to click on a URL Victim Clicks Link Script Embedded in URL Steals Sensitive Info Hacker Victim
- 4. <HTML> <HEAD> <TITLE>Search Example</TITLE> <META http-equiv=quot;content-typequot; content=quot;text/html; charset=utf-8quot;> </HEAD> <BODY> <H1>Search Results</H1> for <SCRIPT>alert(quot;Running!quot;)</SCRIPT> <BR> <BR> <h2>Sorry, no results were found.</h2> <BR> <FORM name=search> <INPUT type=text name=quot;keywordquot; value=“<SCRIPT>alert("Running!")</SCRIPT> <INPUT type=submit value=quot;Goquot;> </FORM> </BODY> </HTML> http://myserver/search.aspx?keyword=<SCRIPT>alert(quot;Running!quot;)</SCRIPT>
- 5. Input Validation Client side?? Request Validation Attribute Output Encoding HTMLEncode – Black listing Microsoft Anti-Cross Site Scripting Library - Whitelisting
- 6. Hacker Injects Script to Datastore When Victim visits, it is run on their machine Hacker Victim
- 7. First Name Last Name Comments <script> Anything</script>
- 8. Input Validation Client side?? Request Validation Attribute Output Encoding HTMLEncode – Black listing Microsoft Anti-Cross Site Scripting Library - Whitelisting
- 9. Hacker Injects Script to Datastore When Victim visits, it is run on their machine Victim X Hacker
- 10. <HTML> <TITLE>Welcome!</TITLE> Hi <SCRIPT> var pos=document.URL.indexOf(quot;name=quot;)+5; document.write(document.URL.substring(pos,document.URL.length)); </SCRIPT> <BR> Welcome to our system … </HTML> http://www.vulnerable.site/welcome.html#name=<script>alert(document.cookie)<script>
- 11. Javascript Hardening Analyze Dom Modifications document window Eval() (don’t use) Regular Expressions Remember Hacker can see your javascript Use a JSON Parser instead of Eval() (www.json.org)
- 12. © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.