DESCRIPTION:
Cross-site scripting (XSS) vulnerability is one of the most prevalent, obstinate, and dangerous vulnerabilities in web applications.
-
Data enters a web application through an untrusted source, most often as a web request.
-
The data is included in a dynamic content that is sent to a web user without being validated for malicious content.
The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash, or any other type of code that the browser may execute. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data, like cookies or other session information to the attacker, thus redirecting the victim to web content controlled by the attacker.
CONTENTS:
Stored and reflected xss attacks
PROBLEM LOCATION
GENERAL TOOLS USED
MITIGATIONS AND CONCLUSION
HOW BRISKINFOSEC HELPS YOU?
CURIOUS TO READ OUR CASE STUDIES?
LAST BUT NOT THE LEAST
YOU MAY BE INTERESTED ON
Stored and Reflected XSS Attacks:
Stored XSS Attacks
Stored attacks are those where the injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information. Stored XSS is also sometimes referred to as “Persistent or Type-I XSS”.
Reflected XSS Attacks
Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as a part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other website. When a user is tricked into clicking on a malicious link, the injected code travels to the vulnerable website, which reflects the attack back to the user’s browser. The browser then executes the code because it came from a “trusted” server. Reflected XSS is also sometimes referred to as “Non-Persistent or Type-II XSS”.
DOM XSS Attacks
DOM Based XSS (or as it is called in some texts), is an XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client side script.
That is, the page itself (the HTTP response that is) does not change, but the client side code contained in the page executes differently due to the malicious modifications that have occurred in the DOM environment.
PROBLEM LOCATION:
-
Common Parameter or Injection Points example (Customizable Themes & Profiles via CSS,Event or meeting names, URI based, Imported from a 3rd party (think Facebook integration), JSON POST values (check returning content type), File Upload names, Uploaded files (swf, HTML, ++), Login and Forgot password forms, Custom Error pages, params – ?realparam=1&foo=bar’+alert(/XSS/)+’.
-
Popular Sources (document.URL, document. documentURI, location.href, location. Search, location.*, window.name, document. Referrer).
-
Popular Sinks (HTML Modification sinks document). Write (element). innerHTML. HTML modification to behaviour change (element).src (in certain elements) Execution Related sinks eval setTimout / setInterval execScript).
GENERAL TOOLS:
-
Burp suite.
-
Xenotix xss.
MITIGATION AND CONCLUSION:
Encode all fields when displaying them in the browser. Additionally, ensure that user input is properly filtered especially in the case of special characters. Ensure that cookie properties (such as HTTP Only) and security headers are set accordingly. A Web Application Firewall (WAF) is the most commonly used solution for protection against XSS and other web application attacks. Implement Content Security Policy (CSP) header as well.
HOW BRISKINFOSEC HELPS YOU?
Briskinfosec validates the inputs properly before updating them in the website. After updating them, our security professionals ensure if they’re done successfully. Apart from these, we provide dexterous security assessments. Hence, without wasting much time, contact us and we’ll fulfil your security requirements to the fullest.
CURIOUS TO READ OUR CASE STUDIES?
We have a vast collection of case studies. All those case studies demonstrate the various security assessments we performed to eliminate the vulnerabilities that were existing in our client’s applications. To exactly know the way we did, check out our case studies.
LAST BUT NOT THE LEAST:
Briskinfosec prepares Threatsploit Adversary Report which contains a significant collection of global cyberattacks, the consequences faced by organisations, and much more. Just a single click on the above link. You’ll feel elated with what you’ve procured.