XSS - Cross Site Scripting
Penetrating testing with Yogesh and Abhinav
- Cross-Site Scripting (XSS)
- XSS Statistics and Impact
- Types of XSS
- Stored XSS
- Reflected XSS
- DOM XSS
- Practical Demo's
AGENDA
Why do you want to hack?
What is XSS?
"An XSS attack occurs when a script from an untrusted source is executed in rendering a page" [*]
XSS according to OWASP
"Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites"
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
XSS Statistics
According to OWASP Top 10 2017, XSS is at #7
Some STATISTICS about XSS
According to HackerOne --
Trustwave Global Security Report
-
How the malicious JavaScript is injected?
XSS Overview
-
The consequences of malicious JavaScript
XSS Attacks - Stored XSS
XSS Attacks - Reflected XSS
XSS Attacks - DOM-based XSS
Getting Bored ...
Example #1
Mission Objective
Inject a script to pop up a JavaScript alert() in the below URL
<script>alert("123")</script>XSS Vector
Example #2
Mission Objective
Inject a script to pop up an alert() in the context of the application.
Note: the application saves your posts so if you sneak in code to execute the alert, this level will be solved every time you reload it.
Entering a <script> tag on this level will not work
Is XSS Possible?
