SlideSet #20: Input Validation and Cross-site Scripting Attacks (XSS) SY306 Web and Databases for Cyber Operations

How does a user input information to your site? How does your server-side code process the input? How do you store the input? Does the input later appear on your site? Verbatim? Input to your Website

Lab Exercise Teams of 3 Visit this website, and post a message! –

Lab Exercise Teams of 3 Visit this website, and post a message! – –X is your group number: 1,2,3,4,5,6,7 –Ex. group 2 is: group2/bufftalk.pyEx. group 2 is: group2/bufftalk.py Now break it to mess up the display – no JavaScript.

Displaying User Content ** Dangerous, but necessary in all social media! Bare Minimum Security Options 1.Check all strings for HTML tags, reject them 2.Replace characters with > and < 3.(need a lot more if databases are involved)

Injection: HTML vs Javascript HTML injection can ruin a page’s display, but not much else Javascript injection can steal information –It can read your cookies –Redirect to other (fake) websites

Lab Exercise 1.Inject Javascript, but do not break the page. –Why would a malicious hacker not want to visibly break it? 2.Find out what cookies are stored for the page 3.Inject Javascript to display the user’s name to the screen (“I see you username”).

Cross-site Scripting (XSS) Trick client browser to execute malicious code (JS/HTML) Targets clients of Web applications, not application itself Parties involved: –Attacker –Server –Client (victim) – runs malicious code in browser

Cross-site scripting attacks 1.Victim uses a web site that sets cookies on victim’s browser 2.Victim clicks on a URL link or visits web site containing evil script 3.Victim’s browser transmits evil code to the target site as a HTTP request 4.Target site reflects the evil code back to the victim’s browser in response to the request 5.Evil script executes within victim’s browser under the security context of the target site

Reflective XSS E.g. URL link contains malicious script. Victim Attacker Application 1. Victim logs into facebook.php in and is issued cookie: Set-Cookie: sessionID=abc Victim clicks on URL: var a=new Image(); a.src=‘ 3. Victim send HTTP GET request for var a=new Image(); a.src=‘ 4 & 5. Victim executes the javascript 6. Attacker hicjacks victim’s facebook session using their sessionID

Stored XSS Malicious post on public forum contains malicious script which will execute on victim’s browser Victim Attacker Application 1. Victim logs into facebook.php in and is issued cookie: Set-Cookie: sessionID=abc Attacker posts “ document.writeln(‘ “ to Victims FB wall 3. Victim see’s FB wall and sends HTTP GET request to 4 & 5. Victim executes the javascript 6. Attacker hijacks victim’s facebook session using their sessionID

Causes of XSS Failed input validation User input is displayed back in the same form Attacker injects malicious code into non-malicious site –Client gets the code from the website, cannot distinguish between legit and malicious content

Let’s just block !! Easy enough: check all input strings for and reject them Is that good enough?

XSS Defense Input filtering Set encoding of HTML pages Output encoding More at: vention_Cheat_Sheet vention_Cheat_Sheet