[ xss ] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~ Serundeng Sapi - Web Application Security ~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [*] reflected xss; stored xss;dom-based xss(like reflected but not in the response, the user's browser executes the script because it copies data from the url) [###] Attacks: [*] defacement [*] webmails [*] trojan functionality [*] induce users to submit forms,... [*] trust relationships: >>> autocomplete enabled in the autocomplete cache, instantiating the relevant form, wait for the browser to autocomplete its contents, and querying the field values. >>> Trusted Sites >> arbitrary code execution on the computer of the victim >>> ActiveX controls circumvented. further payloads:keylogger,port-scanning on the local network, browser's history,... [###] delivery: spear phishing (administrators are the targets). IMG tag is enough for exploiting a vulnerable XSS on a page. When the parameters vulnerable must be exploited with post, post method can be implemented in malicious webpages with forms submitted by Javascript. banner ads... email services like "tell a friend" can be used for delivery of malicious urls -often more reliable... [###] XSS stored, entry points: [-] personal information fields. [-] files, docs uploaded- names and contents. [-] feedback or questions, forums... [-] messages,status updates,comments,... [-] logs such as Referer, User-Agent... [###] identification: standard: "> common filters are of: "> "%3e%3cscript%3ealert(1)%3c/script%3e %00"> dom-based XSS vulnerabilities requires some other action from the user. [###] approach: [-] find entry points mapping the application [-] submit garbage everywhere one by one and see if it is returned in the response. [-] change request method in BURP tell us if a POST request can be delivered as GET. because the attack vectors for GET requests is larger than for POST. [-] common XSS vulnerabilities are in the Header: Referer, Host, User-Agent... [*] Recognize tag attributes like input: custom injection on the input tag: " onfocus="alert(1) custom injection: ";alert(1);var foo=" ";alert(1);// (comment out the rest of the line) click... custom injection: javascript:alert(1); #" onclick="javascript:alert(1) URL-encode characters such as &=+; and space. [###] Defensive Filters: [**] WAF or application anti-XSS filters, signature-based: error messages tipically "> <---------base64 encode the script >>>> event-handlers no user interaction: