Google’s Gruyere1 : An XSS Example Presented by: Terry Gregory

Contents Brief Technical Overview Cross-Site Scripting (XSS) Google’s Gruyere Examples of XSS using Google’s Gruyere Detection Methods & Prevention Conclusion References

Technical Overview: XSS XSS Vulnerabilities Permits attacker to inject code (typically HTML or JavaScript) into contents of a website Injected Code subsequently executes in a victim's browser when victim views the page Bypasses browser's Same Origin Policy, permitting attacker to steal victim's private information associated with website in question The result of improper "sanitizing"/ filtering of user input Common method of attack is to enter random text into input fields and look at how it gets rendered in the response page's HTML source

Technical Overview: XSS Flavors of XSS Attacks: Stored XSS Attacker places malicious code within the application (e.g., in a text snippet) and the victim triggers the attack by browsing to the page on the server that renders the attack File Upload XSS Attacker places malicious code in a file, which a victim unwittingly triggers when the file is accessed Reflected XSS Attacker places malicious code in a request itself (frequently a URL) and the vulnerability occurs when the server inserts the attack in a response verbatim (or incorrectly sanitized). Victim triggers the attack by browsing to the malicious URL created by the attacker

Technical Overview: Google Gruyere Why Google Gruyere? A deliberately vulnerable teaching web application Modeled after a basic social networking application, where users can... Post "snippets“ (for public consumption) Upload files (for public consumption) Sandboxed - meant to be exploited in a consequence-free environment Intended to illustrate: How an application can be attacked using common web security vulnerabilities How to detect and avoid these common vulnerabilities Penetration Testing - Don your Black Hat & prepare to do some Black Box (Abuse Case) hacking...

Example: Stored XSS Attacker’s Challenge: Place malicious code within the application (e.g., in a text snippet) which a victim would trigger when browsing to the page on the server that renders the attack Web Application http://google-gruyere.appspot.com/462526305993/ Illustrations: Note: alert() function – a simple, useful JavaScript function for hacking Not Activated2 : <script type="text/javascript">alert('hey!')</script> Using Innocuous Tags: <a onmouseover="alert('hey!')" href="#">read this!</a> More Dangerous: <a onmouseover="alert(document.cookie)" href="#">read this too!</a>

Example: File Upload XSS Attacker’s Challenge: Place malicious code within a file, which a victim unwittingly triggers when the file is accessed Web Application http://google-gruyere.appspot.com/462526305993/ Illustration: Note: alert() function – a simple, useful JavaScript function for hacking File: fileupload.html <script> alert(document.cookie); </script>

Example: Reflected XSS Attacker’s Challenge: Place malicious code in a request itself (frequently a URL). Server echoes the attack in its response, verbatim. Victim triggers the attack by browsing to the malicious URL Hypothetical Scenario: 1. Suppose URL http://www.google.com/search?q=flowers returns a page containing the HTML fragment <p>Your search for 'flowers‘ returned the following results:</p> (i.e., “q” rendered verbatim)* 2. Attacker could craft a link that looks like this http://www.google.com/search?q=flowers+%3Cscript%3Eevil_script()%3C/script%3E 3. When victim clicks this link (is tricked), page is loaded & “evil script” is executed within the victim’s browser.

XSS Detection Methods & Avoidance A difficult problem Easy to fix – apply correct sanitizing functions/filters to user input Hard to get right – best practices often not followed No Magic Defense Developers need to sanitize input using templates (centralizes & standardizes filtering) Code Reviews Automated Web Vulnerability scans (Tools) Employing good Testing Practices with respect to XSS OWASP XSS Prevention Cheat Sheet3

Conclusion XSS vulnerabilities are some of the most common found in web applications Huge number of XSS Attack Vectors Google Gruyere is a useful tool for Learning how hackers locate & exploit common web application security vulnerabilities (beyond XSS) Learning how to avoid them Honing your own Penetration Test skills using both White Box & Black Box techniques Practicing in a consequence-free environment Site provides Attack Challenges, with associated Hints & Solutions

References [1] Bruce Leban, Mugdha Bendre, and Parisa Tabriz. Web Application Exploits and Defenses. https://google-gruyere.appspot.com/, 2010. [2] Joe Marshall. A Gentle Guide to Cross-Site Scripting (XSS). https://www.airpair.com/security/posts/a-gentle-guide-to-crosssite-scripting-xss, 2015. [3] OWASP: XSS (Cross Site Scripting) Prevention Cheat Sheet. https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet, Last Revised 3/27/16.