The XSS Files Find, Exploit, and Eliminate

Josh Little Security Engineer at global vertical market business intelligence company. 9 years in application support, developer relations, and application review. OWASP Detroit Chapter Leader & a #misec founding member GSEC, CISSP in limbo 2

What is a XSS flaw? XSS = ‘Cross Site Scripting’ Injection of arbitrary code into a user’s browser session #2 on the 2010 OWASP Top 10 and has been on the list since the beginning 3

Causes of XSS Flaws Failure of the application to properly sanitize output to the user’s browser. Improper trust of of user supplied data. 4 $a = $_GET['search']; print 'Your search results '.$a;

Effects of XSS Theft of session cookies Arbitrary HTML or Javascript injection Exploit injection Keystroke Logging BeEF & Metasploit can be used to show effects of XSS 5

Reflective vs. Persistent Reflective – Payload tied to specific URL. Visit the link, hit the payload. Persistent – Embeds the payload into the page (think comments, forum posts, etc.) 6

DOM Based XSS XSS based on the DOM's (Document Object Model) response to the incoming code and other page/request elements. Does not require dynamic server-side code. 7 document.write("Site is at: " + document.location.href + ".");

Finding XSS Flaws Basic test: Determine how application handles 'special' characters such as " ' If the application returns these characters unencoded, it's possibly (and probably) vulnerable. 8

9 Automated scanning – Can test a large number of test cases quickly. Not complete, but a good method to find low-hanging fruit quickly. Source Code Review – Unsanitized use of input is fairly self evident in code review. Time consuming, however, and complex code can make it difficult to follow input paths. As with other flaws, a multi-pronged approach is best.

Preventing XSS Input whitelisting Context sensitive output encoding Javascript, Actionscript, HTML, CSS, etc. must all be treated differently. Just encoding for HTML will not prevent all issues. 10

Context is Key HTML Body HTML Attributes Context URL Context 11 *courtesy of Jim Manico

12 Data TypeContextDefense Numeric, Type safe languageDoesn’t MatterCast to Numeric StringHTML BodyHTML Entity Encode StringHTML Attribute, quotedMinimal Attribute Encoding StringHTML Attribute, unquotedMaximum Attribute Encoding StringGET ParameterURL Encoding StringUntrusted URLURL Validation, avoid javascript: URL’s, Attribute encoding, safe URL verification StringCSSStrict structural validation, CSS Hex encoding, good design HTMLHTML BodyHTML Validation (JSoup, AntiSamy, HTML Sanitizer) AnyDOMDOM XSS Cheat sheet Untrusted JavaScriptAnySandboxing JSONClient parse timeJSON.parse() or json2.js *courtesy of Jim Manico

13 To be truly successful, sanitization should be part of the development framework and not optional. Most successful when the decision on whether to apply sanitization is not up to the individual developer but enforced by the development environment.

Anti-XSS Frameworks.NET – MS AntiXSS Library JAVA,.NET – OWASP AntiSAMY my_Project my_Project Javascript – Google CAJA

Browser Based Defenses Most modern browsers have some form of XSS protection either built-in or via a 3 rd party plugin (i.e. NoScript) Bad code is still bad code – don't rely on the browser for defense. 15

DEMOS Basic XSS Examples 16

Demos All demos are available at Feel free to play with them and use them in additional demonstrations. 17

#1 Basic XSS & Mitigation Strategies Mitigation Strategies: Basic – Strips tags Good – Encodes output within HTML context Textarea – Encloses error message in a tag 18

#2 Attacking incomplete filtering No input written to page body, so we're safe, right? Search term written to tag without sanitization 19

#3 XSS with Style Don't confuse limited means of input with limited input Some apps respond to multiple HTTP methods Cookies can provide a method of persistence within a user's browser session. 20

#4 DOM Based XSS Site builds comment link with ref to current URL. # tag in URL before payload prevents attack from showing up in server logs 21

#5 XSS through POST Apps using only the POST method are not immune to XSS Requires the use of secondary page to build & submit the exploitable form 22

QUESTIONS? 23