What is Cross-Site Scripting?

What is Cross-Site Scripting (XSS)?

Cross-Site Scripting (XSS) attacks are a type of injection problem, in which malicious scripts are injected into the otherwise trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.
XSS attacks can generally be categorized into two categories:
  • Stored XSS Attacks –

Injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log or comment field. The victim then retrieves the malicious script from the server when it requests the stored information. Stored XSS is also sometimes referred to as Persistent or Type-I XSS.

This vulnerability can be used to conduct a number of browser-based attacks including:

  1. Hijacking another user’s browser
  2. Capturing sensitive information viewed by application users
  3. Pseudo defacement of the application
  4. Port scanning of internal hosts (“internal” in relation to the users of the web application)
  5. Directed delivery of browser-based exploits
  6. Other malicious activities

Stored XSS does not need a malicious link to be exploited. A successful exploitation occurs when a user visits a page with a
stored XSS.

  • Reflected XSS Attacks –

Injected script is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other web site. When a user is tricked into clicking on a malicious link, submitting a specially crafted form, or even just browsing to a malicious site, the injected code travels to the vulnerable web site, which reflects the attack back to the user’s browser. The browser then executes the code because it came from a “trusted” server. Reflected XSS is also sometimes referred to as Non-Persistent or Type-II XSS.

Testing for XSS Vulnerability

XSS flaws can be difficult to identify and remove from a web application. The best way to find flaws is to perform a security review of the code and search for all places where input from an HTTP request could possibly make its way into the HTML output. Every data entry point can result in an XSS attack.
Enter following  script
 <IMG SRC=javascript:alert('XSS')>

A browser pop-up titled “XSS” might come up if not dealing with XSS correctly.

<body onload=alert('test1')> 
<b onmouseover=alert('Wufff!')>click me!</b> 
<img src="http://url.to.file.which/not.exist" onerror=alert(document.cookie);>

Tools for testing XSS vulnerability

  • Burp Suite
  • XSS-Me

We will cover the details of the tools in future posts.

 

One comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.