This document discusses cross-site scripting (XSS) and SQL injection vulnerabilities. It provides an example of how Samy used an XSS attack on MySpace to automatically send friend requests to over 1 million users in just 20 hours. It also discusses how SQL injection allows hackers to extract data by manipulating queries, and provides examples of how injecting code into the username, password, or ID fields can expose user data or union queries. The document aims to demonstrate how these attacks work and why they remain prevalent issues.

1. LET'S H4CK
By H4rryp0tt3r

2. 2
XSS
(Xross Site Scripting)

3. 3
Not so powerful?
● What XSS means to most of the people at first is, XSS
won't be a big issue. It won't be very harmful.
● And If you report an XSS bug, the very first question is,
“what harm you can do by popping up an alert box?”

4. 4

5. 5
● Samy wants to become every ones hero
● No more waiting, He wrote a JavaScript
● Injected into his profile page
He wants to be a hero..

6. 6
What that script will do?
If you visit Samy's profile, then that code will execute in
your browser.
Samy's
Profile
with
Injected
Code
Victim's profile
Add Samy to my hero's list
Send a friend request to Samy
MySpace Server
It will send a friend request to Samy on behalf of you
Injected
code gets
copied to
your profile
Now Samy is victim's Hero

7. 7
So many friends...
At 12:30 am: You have 73 friends.
1 hour later, 1:30 am: You have 73 friends and 1 friend request.
8 hour later, 8:30 am: You have 518 friends and 561 friend requests.
10 hours later, 10:30 am: You have 2,503 friends and 6,373 friend requests.
13 hours later, 1:30 pm: You have 2,503 friends. 917,084 friend requests.
A few minutes later, I refresh. 1,005,831 friend requests.

8. 8
One can't say that anymore...
In just 20 hours over one million people got affected by a
JavaScript worm called Samy Worm that spread on
MySpace(A social networking website once upon a time)

9. 9
https://www.google.com/about/appsecurity/learning/xss/
https://google-gruyere.appspot.com/start
Simple XSS Demo URL

10. 10
SQL Injection

11. 11
Stays for ever...
● Ranked 1st in OWASP Top 10 vulnerabilities
● 97% of data breaches are still due to SQL Injection
● The most common form of attack against websites

12. 12
May be the largest ever breach...
Hackers exposed 130 million card numbers
from Heartland Payment system in 2007

13. 13
select * from <some-table> where username='<user-input>'
and password='<user-input>'
Basic Login validation query..
select * from <some-table> where username='admin' or 1=1 #'
and password='<user-input>'

14. 14
select * from <some-table> where id = <user-given-id>
ID based content selection query
select * from <some-table> where id = 1 UNION select 1,2,3
select * from <some-table> where id = 1 AND 1=0 UNION select
1,2,3

15. THANKS
For questions or suggestions:
Nagesh Podilapu
nagesh.podilapu@thoughtworks.com