An Introduction to Web Application Security Class 4: Cross Site Scripting December 18th 2014 Daniel Somerfield Lead Consulting Developer ThoughtWorks

This Week’s Agenda December 15th: Introduction to AppSec December 16th: Injection December 17th: Vulnerable Authentication & Session Management December 18th: Cross-Site Scripting December 19th: Secure Development Process

What is XSS? Cross-site scripting (XSS) occurs when an attacker maliciously submits data that the application renders to users in a context that alters the behavior or presentation of the site in a way not intended by the application developer.

What is XSS? The simple definition. JavaScript, HTML, or CSS where it doesn’t belong messing with your app.

What’s the threat? Confidentiality ✓ Integrity ✓ Availability

Types of XSS Persistent XSS Server Reflected XSS Client Reflected or DOM-based XSS

Persistent XSS Attacker User Server DB 1. POST <script>myEvilJS();</script> 3. GET /corrupted-page.html 5. RENDER <script>myEvilJS();</script> Server 2. INSERT <script>myEvilJS();</script> 4. SELECT <script>myEvilJS();</script> DB

Reflected XSS Attacker User Server 1. Send URL: http://example.com?param=<script>myEvilJS();</script> Attacker User 3. RENDER <script>myEvilJS();</script> 2. GET http://example.com?param=<script>myEvilJS();</script> Server

https://github.com/danielsomerfield/app-sec-demo Authentication Demo Demo pages: http://appsec-demo.herokuapp.com/AppSecDemo/demo/ https://appsec-demo.herokuapp.com/AppSecDemo/demo/entry/?entryId=<entryid> Source code: https://github.com/danielsomerfield/app-sec-demo

XSS Demo: Reflected XSS

XSS Demo: Reflected XSS https://appsec-demo.herokuapp.com/AppSecDemo/demo/entry/?entryId=0

XSS Demo: Reflected XSS https://appsec-demo.herokuapp.com/AppSecDemo/demo/entry/?entryId=%3Cscript%3Ealert(%22gotcha!%22)%3C/script%3E Google\ Chrome --user-data-dir=/tmp/dummy --disable-xss-auditor

Defending against XSS Input validation Output encoding Safe script includes Avoid mixed contexts Avoid "unsafe" JavaScript like eval() and innerHTML

Input Validation, Basic Case Decimal to hex converter Input Output 42 2a 2001 7da <script>alert(“gotcha”);</script> ???

“Foo bar” is not an acceptable input. Please enter a decimal number. Being too helpful “Foo bar” is not an acceptable input. Please enter a decimal number. OK

More complex cases A web-based email client A web-based ssh client Or, heaven help you, a web-based HTML editor

Browser Rendering Contexts HTML context HTML attribute context JavaScript context JavaScript string context CSS context JSON entity context URL context

What is Output Encoding Escaping characters and sequences so they do not render in the wrong context

HTML Output Encoding $attackerInput = "<img src='http://evil.org/deface.gif'>" <p>$attackerInput</p> Un-encoded: <p><img src='http://evil.org/deface.gif'></p> Encoded: <p>lt;img src='http://evil.org/deface.gif';></p>

JavaScript String Output Encoding $attackerInput="\"); alert('gotcha');//" <script> doSomething("$attackerInput"); </script> Unescaped doSomething(""); alert('gotcha');//"); Escaped doSomething("\x22\x29\x3B\x20alert\x28\x27gotcha\x27\x29\x3B\x2F\x2F");

What is CSRF? Cross Site Request Forgery: using the existing browser session to perform a privileged operation the user doesn't intend or expect.

Defending Against CSRF Tokenizer pattern Built in CSRF protection is included in many frameworks Double submission Avoid POST, GET for modifying operations

References OWASP XSS Cheat Sheethttps://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet OWASP CSRF Cheat Sheethttps://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet OWASP Top 10 - A3 – Cross-Site Scriptinghttps://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_(XSS) OWASP Top 10 - A8 – Cross-Site Request Forgeryhttps://www.owasp.org/index.php/Top_10_2013-A8-Cross-Site_Request_Forgery_(CSRF)

This Week’s Agenda December 15th: Introduction to AppSec December 16th: Injection December 17th: Vulnerable Authentication & Session Management December 18th: Cross-Site Scripting December 19th: Secure Development Process