XSS

XSS CROSS SITE SCRIPTING

Ivan Banov Front-end Engineer

What is?

OWASP OWASP is a non-proﬁt organization with the goal of
improving the security of software and the internet

OWASP 1 - Injection 2 - Broken Authentication and Session
Management (XSS) 3 - Cross Site Scripting (XSS) 4 - Insecure Direct Object References 5 - Security Misconﬁguration 6 - Sensitive Data Exposure 7 - Missing Function Level Access Control 8 - Cross Site Request Forgery (CSRF) 9 - Using Components with Known Vulnerabilities 10 - Unvalidated Redirects and Forwards

Stored Reﬂected DOM-based

Store This is when an attacker could inject script code
onto your site permanently and every user who views the page where the script is injected will execute it.

POST <script>xss</script> DATABASE lastComment: <script>xss</script> REPONSE <html> <h1>Comments</h1>  ... <script>xss</script>
// lastComment </html> POST

Reﬂected This is when an attacker could forge a link
to inject script code that will execute from your website. This is also the most common type of XSS

FAKE LINK http://site.com/?query=<script>xss</script> RESPONSE WITH XSS <html> <h1>Your search <script>xss</script></h1>
 </html> RECEIVE DATA e.g. document.cookie POST

DOM-based This kind of XSS is executed at some point
after the page has loaded, many time needs user interaction, which means that the attacker must trick the user to execute the script himself. This one is very similar to the reﬂected XSS, but for needing user interaction makes it harder for the attacker

FAKE LINK http://site.com/?query=<script>xss</script> DOM USE QUERY <html> <button onclick="javascript:search()"> Search
</button> </html> // search uses query param and BANG! RECEIVE DATA e.g. document.cookie POST

DOUBLE ENCODED XSS NOT ENCODED <script>alert('XSS')</script> ENCODED %3Cscript%3Ealert('XSS')%3C%2Fscript%3E DOUBLE ENCODED
%253Cscript%253Ealert('XSS')%253C%252Fscript%253E

DATA ENCODE https://site.com/#data:text/plain,alert('xss')

XSS ON REACT

XSS ON REACT { user: { username: "Xss User", bio:
"...</script><script>xss</script>" } }

XSS ON REACT

LET'S PLAY https://xss-game.appspot.com/

REFERENCES - https://medium.com/node-security/the-most-common-xss- vulnerability-in-react-js-applications-2bdffbcc1fa0#.tth9q6chn - http://redux.js.org/docs/recipes/ServerRendering.html - https://blog.detectify.com/2012/09/22/the-basics-of-cross-site- scripting-xss/ -
https://whitton.io/tags/#xss - https://excess-xss.com/

THANK YOU

XSS

XSS

Ivan Banov

More Decks by Ivan Banov

Other Decks in Technology

Featured

Transcript

XSS CROSS SITE SCRIPTING

Ivan Banov Front-end Engineer

What is?

OWASP OWASP is a non-proﬁt organization with the goal of

OWASP 1 - Injection 2 - Broken Authentication and Session

OWASP 1 - Injection 2 - Broken Authentication and Session

Stored Reﬂected DOM-based

Store This is when an attacker could inject script code

POST <script>xss</script> DATABASE lastComment: <script>xss</script> REPONSE <html> <h1>Comments</h1>  ... <script>xss</script>

Reﬂected This is when an attacker could forge a link

FAKE LINK http://site.com/?query=<script>xss</script> RESPONSE WITH XSS <html> <h1>Your search <script>xss</script></h1>

DOM-based This kind of XSS is executed at some point

FAKE LINK http://site.com/?query=<script>xss</script> DOM USE QUERY <html> <button onclick="javascript:search()"> Search

DOUBLE ENCODED XSS NOT ENCODED <script>alert('XSS')</script> ENCODED %3Cscript%3Ealert('XSS')%3C%2Fscript%3E DOUBLE ENCODED

DATA ENCODE https://site.com/#data:text/plain,alert('xss')

XSS ON REACT

XSS ON REACT { user: { username: "Xss User", bio:

XSS ON REACT

LET'S PLAY https://xss-game.appspot.com/

REFERENCES - https://medium.com/node-security/the-most-common-xss- vulnerability-in-react-js-applications-2bdffbcc1fa0#.tth9q6chn - http://redux.js.org/docs/recipes/ServerRendering.html - https://blog.detectify.com/2012/09/22/the-basics-of-cross-site- scripting-xss/ -

THANK YOU