XSS Attacks
Cross Site Scripting Attacks
Presented by:
Syed Muhammad Taha
Saad Abbasi
Presented to:
Dr. Saleem Ahmed Phul
XSS
- A client-side code injection attack.
- Attacker Executes malicious scripts into a legitimate website or web app.
- The most rampant of web application vulnerabilities.
Source: Acunetix
Two-third
- More than
of web vulnerabilities are
XSS
related.
- Famous sites that are affected by XSS, include
Twitter, Facebook, MySpace, YouTube
How Much Rampant?
12.75%
- Almost
of web attacks are XSS.
Source: Barricade
Languages
- XSS can be taken advantage of within
VBScript,
ActiveX, Flash.
- The most widely abused language is
JavaScript.
Types of XSS Attacks
- Server XSS
- Client XSS
Server XSS
-
When untrusted user supplied data is included in an HTML response generated by the server.
-
The source of this data could be from the request, or from a stored location.
-
The source of this data could be from the request, or from a stored location.
Client XSS
-
When untrusted user supplied data is used to update the DOM with an unsafe JavaScript call.
-
A JavaScript call is considered unsafe if it can be used to introduce valid JavaScript into the DOM.
-
This source of this data could be from the DOM, or it could have been sent by the server (via an AJAX call, or a page load)
Types of XSS Attacks
Well, How Serious XSS could be?
If XSS got injected then a hacker could:
-
use the credibility of your site to run a phishing scheme
-
steal your users' passwords
-
hijack your users' sessions
-
try to launch an attack against the site administrator (you)
-
redirect your users to another site (gambling, Google, affiliate link, whatever)
-
display inappropriate or mis-informative messages to your users
-
Or anything else that could be done with client-side executable code
Source: 12robots
XSS Demo
XSS Prevention Rules
- Rule#0 - Never Insert Untrusted Data Except in Allowed Locations
- Rule#1 - HTML Escape Before Inserting Untrusted Data into HTML Element Content
- RULE #2 - Attribute Escape Before Inserting Untrusted Data into HTML Common Attributes
- RULE #3 - JavaScript Escape Before Inserting Untrusted Data into JavaScript Data Values
- RULE #4 - CSS Escape And Strictly Validate Before Inserting Untrusted Data into HTML Style Property Values
- RULE #5 - URL Escape Before Inserting Untrusted Data into HTML URL Parameter Values
- RULE #6 - Sanitize HTML Markup with a Library Designed for the Job
- RULE #7 - Prevent DOM-based XSS
Source: owasp
XSS
By Syed M. Taha
XSS
A presentation on Cross Site Scripting Acttack
- 247
