XSS CROSS SITE SCRIPTING 

Ivan Banov Front-end Engineer 

What is? 

OWASP OWASP is a non-profit organization with the goal of improving the security of software and the internet 

OWASP 1 - Injection 2 - Broken Authentication and Session Management (XSS) 3 - Cross Site Scripting (XSS) 4 - Insecure Direct Object References 5 - Security Misconfiguration 6 - Sensitive Data Exposure 7 - Missing Function Level Access Control 8 - Cross Site Request Forgery (CSRF) 9 - Using Components with Known Vulnerabilities 10 - Unvalidated Redirects and Forwards 

OWASP 1 - Injection 2 - Broken Authentication and Session Management (XSS) 3 - Cross Site Scripting (XSS) 4 - Insecure Direct Object References 5 - Security Misconfiguration 6 - Sensitive Data Exposure 7 - Missing Function Level Access Control 8 - Cross Site Request Forgery (CSRF) 9 - Using Components with Known Vulnerabilities 10 - Unvalidated Redirects and Forwards 

Stored Reflected DOM-based 

Store This is when an attacker could inject script code onto your site permanently and every user who views the page where the script is injected will execute it. 

POST xss DATABASE lastComment: xss REPONSE

Comments


 ... xss // lastComment POST 

Reflected This is when an attacker could forge a link to inject script code that will execute from your website. This is also the most common type of XSS 

FAKE LINK http://site.com/?query=xss RESPONSE WITH XSS

Your search xss

RECEIVE DATA e.g. document.cookie POST 

DOM-based This kind of XSS is executed at some point after the page has loaded, many time needs user interaction, which means that the attacker must trick the user to execute the script himself. This one is very similar to the reflected XSS, but for needing user interaction makes it harder for the attacker 

FAKE LINK http://site.com/?query=xss DOM USE QUERY Search // search uses query param and BANG! RECEIVE DATA e.g. document.cookie POST 

DOUBLE ENCODED XSS NOT ENCODED alert('XSS') ENCODED %3Cscript%3Ealert('XSS')%3C%2Fscript%3E DOUBLE ENCODED %253Cscript%253Ealert('XSS')%253C%252Fscript%253E 

DATA ENCODE https://site.com/#data:text/plain,alert('xss') 

XSS ON REACT 

XSS ON REACT { user: { username: "Xss User", bio: "...xss" } } 

XSS ON REACT 

LET'S PLAY https://xss-game.appspot.com/ 

REFERENCES - https://medium.com/node-security/the-most-common-xss- vulnerability-in-react-js-applications-2bdffbcc1fa0#.tth9q6chn - http://redux.js.org/docs/recipes/ServerRendering.html - https://blog.detectify.com/2012/09/22/the-basics-of-cross-site- scripting-xss/ - https://whitton.io/tags/#xss - https://excess-xss.com/ 

THANK YOU