Group 18: Chris Hood Brett Poche ECE 4112: Lab 9 Web Security Spring Break Edition Group 18: Chris Hood Brett Poche

Outline Cross Site Scripting Definition 3 Main XSS Attacks XSS Defenses Lab Procedures Each week two lab groups will combine to do one brief power point presentation in class on the lab due date. This presentation (and leading of a class discussion) will be a brief summary of 1) the threats and techniques identified in the lab 2) the defenses one could use to protect against those threats

Setup Apache Server – open source HTTP web server PHP – open source, reflective programming language used to develop server-side applications, dynamic web content, and software applications. (MediaWiki) MySQL – SQL Database Management System

Cross Site Scripting XSS refers to a vulnerability in web applications where an attacker can “inject code into a page in a manner such that the web page subsequently executes the code. Seen in dynamic web applications that do not properly validate and escape user input.

XSS Attacks Type 0: DOM-based or local Type 1: Non-persistent or reflected Type 2: Persistent or stored

Type 0 Attack Utilizes JavaScript’s privileges in the “local zone” to execute code Attacks local machine via IE user privileges Example: A web page’s JavaScript is used to launch code stored on a viewer’s computer Not in lab

Type 1 Attack Supplied code is immediately executed by the server Example: Inserting JavaScript directly into search query Lab Section 1

Type 2 Attack Inserted code is directly stored (in a database) and is later displayed without being formatted Example Inserting JavaScript code into a forum message Lab Section 1

Lab Section 1: Cross-Site Scripting Section 2: SQL Injection on Linux Apache Web Server Section 3: Practical Web Exercise on Windows Server

Lab Section 1 Stealing cookies with Type 1 & 2 attacks Cookie – maintain state information Harvesting user names and super secret passwords Lots of sites use cookies to store info, like user name/pass, shopping cart, tracking purposes, etc

Lab Example This was done by placing JavaScript code directly into the URL (type 1 XSS attack)

Lab Example 2 This was done by placing JavaScript directly into the forum message, so it was placed into the HTML and directly interpreted. Both of these aren’t that harmful alone, but they are a good proof of concept along the lines of what can be done and how easy/stealthy it is.

Lab Section 2 SQL injection via query string and login fields Use company’s database against themselves Obtain user information directly from database Select statements inserted directly into URL (**not JavaScript anymore**) Best defense: input validation SQL

XSS Defenses Disable JavaScript Sanitize user input Not feasible Sanitize user input Search input for blacklisted code Other suggestions? Online research led to similar, three results Sanitize, like look for special characters and/or replace all single quotes with double quotes, semi-colons, /* comments, and <> marks Blacklisted code includes code that contains specific SQL queries and/or javascript

Lab Section 3 Basic No-No’s Suggestions for other precautions? Predictable File Locations Weak Password Recovery Information Leakage Suggestions for other precautions? dunce

Wrap-up Cross Site Scripting Definition 3 Main XSS Attacks XSS Defenses Lab Procedures Questions???