What is Cross-Site Scripting (XSS)? XSS types, examples & how to fix. Learning XSS attacks

Опубликовано: 01 Октябрь 2024
на канале: CSI digital

118

What is Cross-Site Scripting (XSS)? XSS types, examples and how to fix. Learn about XSS Vulnerabilities, Injections and fixes

In this episode we are going to talk about Cross-site scripting (XSS). Cross-site scripting has been around for over 15 years but is still used to reek havoc on web systems. One of the most famous attacks was the Myspace “Samy “ exploit back in 2005 which affected over a million people within 20 hours. Other notable XSS exploits include Ebay in 2017, Uber in 2016 and the duckduckgo search engine. Cross-site scripting is often said to be the most common vulnerability, and many sites are affected. This includes small local sites as well as giants like Google. OWASP still lists Cross-site scripting among the top 10 most common critical vulnerabilities even after being around for well over a decade. That’s what we want to take a look at today.

What is Cross-site Scripting
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

How does a cross-site scripting attack work?
An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page.
The main purpose of this attack is usually to steal the other user’s identity data – cookies, session tokens and other information. In most of the cases, this attack is being used to steal the other person‘s cookies. As we know, cookies help us to log in automatically. Therefore with stolen cookies, we can login with the other identities. And this is one of the reasons, why this attack is considered as one of the riskiest attacks.

What is a persistent Cross-site scripting attack?
Stored XSS generally occurs when user input is stored on the target server, such as in a database, in a message forum, visitor log, comment field, etc. And then a victim is able to retrieve the stored data from the web application without that data being made safe to render in the browser. With the advent of HTML5, and other browser technologies, it could be possible that the attack payload gets permanently stored in the victim’s browser, such as an HTML5 database, and never being sent to the server at all.

What is a Non-Persistent Cross-Site Scripting attack?
Reflected XSS occurs when user input is immediately returned by a web application in an error message, search result, or any other response that includes some or all of the input provided by the user as part of the request, without that data being made safe to render in the browser, and without permanently storing the user provided data. In some cases, the user provided data may never even leave the browser.

What is a DOM based Cross-Site Scripting Attack?
As defined by Amit Klein, who published the first article about this issue, DOM Based XSS is a form of XSS where the entire tainted data flow from source to sink takes place in the browser, i.e., the source of the data is in the DOM, the sink is also in the DOM, and the data flow never leaves the browser. For example, the source (where malicious data is read) could be the URL of the page (e.g., document.location.href), or it could be an element of the HTML, and the sink is a sensitive method call that causes the execution of the malicious data (e.g., document.write).

#cross-sitescripting
#cross-sitescriptingattack
#xss
#xssattacks
#xsscheatsheet
#xssexamples