1. Google’s Gruyere1 : An XSS Example Presented by: Terry Gregory

2. Contents Brief Technical Overview Cross-Site Scripting (XSS)
Google’s Gruyere
Examples of XSS using Google’s Gruyere
Detection Methods & Prevention
Conclusion
References

3. Technical Overview: XSS
XSS Vulnerabilities
Permits attacker to inject code (typically HTML or JavaScript) into contents of a website
Injected Code subsequently executes in a victim's browser when victim views the page
Bypasses browser's Same Origin Policy, permitting attacker to steal victim's private information associated with website in question
The result of improper "sanitizing"/ filtering of user input
Common method of attack is to enter random text into input fields and look at how it gets rendered in the response page's HTML source

4. Technical Overview: XSS
Flavors of XSS Attacks:
Stored XSS
Attacker places malicious code within the application (e.g., in a text snippet) and the victim triggers the attack by browsing to the page on the server that renders the attack
File Upload XSS
Attacker places malicious code in a file, which a victim unwittingly triggers when the file is accessed
Reflected XSS
Attacker places malicious code in a request itself (frequently a URL) and the vulnerability occurs when the server inserts the attack in a response verbatim (or incorrectly sanitized). Victim triggers the attack by browsing to the malicious URL created by the attacker

5. Technical Overview: Google Gruyere
Why Google Gruyere?
A deliberately vulnerable teaching web application
Modeled after a basic social networking application, where users can...
Post "snippets“ (for public consumption)
Upload files (for public consumption)
Sandboxed - meant to be exploited in a consequence-free environment
Intended to illustrate:
How an application can be attacked using common web security vulnerabilities
How to detect and avoid these common vulnerabilities
Penetration Testing - Don your Black Hat & prepare to do some Black Box (Abuse Case) hacking...

6. Example: Stored XSS Attacker’s Challenge:
Place malicious code within the application (e.g., in a text snippet) which a victim would trigger when browsing to the page on the server that renders the attack
Web Application
Illustrations:
Note: alert() function – a simple, useful JavaScript function for hacking
Not Activated2 : <script type="text/javascript">alert('hey!')</script>
Using Innocuous Tags: <a onmouseover="alert('hey!')" href="#">read this!</a>
More Dangerous: <a onmouseover="alert(document.cookie)" href="#">read this too!</a>

7. Example: File Upload XSS
Attacker’s Challenge:
Place malicious code within a file, which a victim unwittingly triggers when the file is accessed
Web Application
Illustration:
Note: alert() function – a simple, useful JavaScript function for hacking
File: fileupload.html
<script>
alert(document.cookie);
</script>

8. Example: Reflected XSS
Attacker’s Challenge:
Place malicious code in a request itself (frequently a URL). Server echoes the attack in its response, verbatim. Victim triggers the attack by browsing to the malicious URL
Hypothetical Scenario:
1. Suppose URL returns a page containing the HTML fragment
<p>Your search for 'flowers‘ returned the following results:</p> (i.e., “q” rendered verbatim)*
2. Attacker could craft a link that looks like this
3. When victim clicks this link (is tricked), page is loaded & “evil script” is executed within the victim’s browser.

9. XSS Detection Methods & Avoidance
A difficult problem
Easy to fix – apply correct sanitizing functions/filters to user input
Hard to get right – best practices often not followed
No Magic Defense
Developers need to sanitize input using templates (centralizes & standardizes filtering)
Code Reviews
Automated Web Vulnerability scans (Tools)
Employing good Testing Practices with respect to XSS
OWASP XSS Prevention Cheat Sheet3

10. Conclusion
XSS vulnerabilities are some of the most common found in web applications
Huge number of XSS Attack Vectors
Google Gruyere is a useful tool for
Learning how hackers locate & exploit common web application security vulnerabilities (beyond XSS)
Learning how to avoid them
Honing your own Penetration Test skills using both White Box & Black Box techniques
Practicing in a consequence-free environment
Site provides Attack Challenges, with associated Hints & Solutions

11. References
[1] Bruce Leban, Mugdha Bendre, and Parisa Tabriz. Web Application Exploits and Defenses
[2] Joe Marshall. A Gentle Guide to Cross-Site Scripting (XSS)
[3] OWASP: XSS (Cross Site Scripting) Prevention Cheat Sheet. Last Revised 3/27/16.