This document summarizes a lightning talk on cross-site scripting (XSS) attacks. It defines XSS as the injection of malicious JavaScript onto a website with the intent of client-side execution. There are three main types of XSS attacks: reflected, persistent, and DOM-based. The talk focuses on persistent XSS attacks. It provides examples of how XSS could be used to scan local networks, steal user sessions through cookie theft, and gain complete control of the vulnerable webpage. The document concludes by recommending tools and resources for learning more about conducting white hat XSS testing.

1. March 2012
Introduction to Cross Site Scripting
Lightning talk held at OSAA
Johnny Vestergaard <jkv@unixcluster.dk>
http://dk.linkedin.com/in/johnnykv

2. XSS - Cross Site Scripting
Worst name ever??
● Think of it as "JavaScript Injection".
○ (and ignore the haters)
● Injection of malicious JavaScript on a site with the
intend of client side execution.
● Three types: Reflected, Persistent and DOM based.
● We will focus on Persistent XSS tonight.

3. Safe website

4. Vulnerable website

5. Hey - it's just client side!

6. Having a client side party
● Possibilities
○ Host scanning of client-side LAN
○ Session takeover (cookie stealing)
○ Eavesdropping
■ Keylogging
■ Events
○ Complete control of the page
● Limitations
○ Confined to the browser

7. Demo
● Keylogger using metasploit
● Cookie stealer with python backend

8. Demo #1 - Keylogger with metasploit

9. Demo #2 - The Cookie Monster
https://gist.github.com/1968842

10. Do it yourself
Whitehat style
● Backtrack 5
○ http://www.backtrack-linux.org/
● OWASP Broken Web Applications Project
○ VMware image with broken web apps
○ http://bit.ly/yNsF9K
● Cookie Monster
○ http://gist.github.com/1968842
● Slides
○ http://www.slideshare.net/JohnnyKV/