2.3 Cross Site Scripting

Question 1

Cross Site Scripting

Answer 1

Abbreviation XSS. Cascading style sheets (CSS) are something else entirely.

Originally called cross site because of browser security flaws. Information from one site could be shared with another.

One of the most common web app vulnerabilities. Takes advantage of the trust a user has for a site. Complex and varied.

XSS commonly uses javascript. D

Question 2

Cross Site scripting attack

Answer 2

1. Attacker sends a link containing a malicious script to a victim. 2. Victim clicks link and visits legitimate site. 3. Legitimate site loads in the victim’s browser. Malicious script is also executed. 4. Malicious script sends victims data (session cookies, etc.) to attacker.

Question 3

Non- persistent (reflected) XSS attack.

Answer 3

Web site allows scripts to run in user input. Seach box is common source.

Attacker emails a link that takes advantage of this vulnerability. Runs a script that sends credentials/session IDs/ cookies to the attacker.

Script embedded in URL executes in the victim’s browser. As it came from the server.

Attacker uses credentials/session IDs/ cookies to steal victims’ information without their knowledge. Very sneaky.

Question 4

Vulnerable XSS website (see video)

Question 5

Persistent (stored) XSS attack

Answer 5

Attacker posts a message to a social network. Includes the malicious payload.

It’s now “persistent”. Everyone gets the payload.

No specific target. All viewers to the page.

For social networking this can spread quickly. Everyone who views the message can have it posted to their page. When someone else can view it and propagate it further.

Question 6

Hacking a Subaru

Answer 6

June 2017, Aaron Guzman. Security researcher.

When authenticating with subarau, user gets a token. This token never expires (bad).

A valid token allowed any service request. Even adding your email address to someone’s else’s account. Now you have full access to someone’s else car.

Web front end included an XSS vulnerability. A user clicks a malicious link, and you have their token.

Question 7

Protecting against XSS

Answer 7

Be careful when clicking untrusted links. Never blindly click in your email inbox. Never.

Consider disabling Javascript. Or control with an extension. This offers limited protection.

Keep your browser and applicants updated. Avoid the nasty browser vulnerabilities.

Validate input. Don’t allow users to add their own scripts to an input field.