Cross-site scripting (XSS) is one of the most prevalent, obstinate, and dangerous vulnerabilities in web applications.
- Data enters a Web application through an untrusted source, most frequently as a web request.
- The data is included in dynamic content that is sent to a web user without being validated for malicious content.
Stored and Reflected XSS Attacks Stored XSS Attacks
Stored attacks are those where the injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information. Stored XSS is also sometimes referred to as Persistent or Type-I XSS.
Reflected XSS Attacks
Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other website. When an user is tricked into clicking on a malicious link, submitting a specially crafted form, or even just browsing to a malicious site, then he injected code travels to the vulnerable website, which reflects the attack back to the user’s browser. The browser then executes the code that it came from a “trusted” server. Reflected XSS is also sometimes referred to as Non-Persistent or Type-II XSS.
DOM XSS Attacks
DOM Based XSS (or as it is called in some texts), is an XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client side script.
That is, the page itself (the HTTP response that is) does not change, but the client side code contained in the page executes differently due to the malicious modifications that have occurred in the DOM environment.
- Common Parameter Or Injection Points example (Customizable Themes & Profiles via CSS,Event or meeting names, URI based, Imported from a 3rd party (think Facebook integration),JSON POST Values (check returning content type),File Upload names, Uploaded files (swf, HTML, ++),Login and Forgot password forms, Custom Error pages,params – ?realparam=1&foo=bar’+alert(/XSS/)+’.
- Popular Sources (document.URL, document.documentURI, location.href, location. Search, location.*, window.name, document. Referrer).
- Popular Sinks (HTML Modification sinks document. Write (element)[removed] HTML modification to behaviour change (element).src (in certain elements) Execution Related sinks eval setTimout / setInterval execScript ).
Encode all fields when displaying them in the browser. Additionally, ensure that user input is properly filtered especially in the case of special characters. Ensure that cookie properties (such as HttpOnly) and security headers are set accordingly. A web application firewall (WAF) is the most commonly used solution for protection against XSS and web application attacks. Implement Content Security Policy (CSP) header.
- Burp suite
- Xenotix xss