1. An Introduction to Web Application Security
Class 4: Cross Site Scripting
December 18th 2014 Daniel Somerfield
Lead Consulting Developer
ThoughtWorks

2. This Week’s Agenda
December 15th: Introduction to AppSec December 16th: Injection December 17th: Vulnerable Authentication & Session Management December 18th: Cross-Site Scripting December 19th: Secure Development Process

3. What is XSS?
Cross-site scripting (XSS) occurs when an attacker maliciously submits data that the application renders to users in a context that alters the behavior or presentation of the site in a way not intended by the application developer.

4. What is XSS? The simple definition.
JavaScript, HTML, or CSS where it doesn’t belong messing with your app.

5. What’s the threat?
Confidentiality ✓
Integrity ✓
Availability

6. Types of XSS Persistent XSS Server Reflected XSS
Client Reflected or DOM-based XSS

7. Persistent XSS Attacker User Server DB 1. POST
<script>myEvilJS();</script>
3. GET
/corrupted-page.html
5. RENDER
<script>myEvilJS();</script>
Server
2. INSERT
<script>myEvilJS();</script>
4. SELECT
<script>myEvilJS();</script> DB

8. Reflected XSS Attacker User Server
1. Send URL:
Attacker
User
3. RENDER <script>myEvilJS();</script>
2. GET
Server

9. https://github.com/danielsomerfield/app-sec-demo
Authentication Demo
Demo pages:
Source code:

10. XSS Demo: Reflected XSS

11. XSS Demo: Reflected XSS

12. XSS Demo: Reflected XSS
Google\ Chrome --user-data-dir=/tmp/dummy --disable-xss-auditor

13. Defending against XSS Input validation Output encoding
Safe script includes
Avoid mixed contexts
Avoid "unsafe" JavaScript like eval() and innerHTML

14. Input Validation, Basic Case
Decimal to hex converter
Input
Output 42 2a
2001
7da
<script>alert(“gotcha”);</script>
???

15. “Foo bar” is not an acceptable input. Please enter a decimal number.
Being too helpful
“Foo bar” is not an acceptable input. Please enter a decimal number. OK

16. More complex cases A web-based email client A web-based ssh client
Or, heaven help you, a web-based HTML editor

17. Browser Rendering Contexts
HTML context
HTML attribute context
JavaScript context
JavaScript string context
CSS context
JSON entity context
URL context

18. What is Output Encoding
Escaping characters and sequences so they do not render in the wrong context

19. HTML Output Encoding
$attackerInput = "<img src=' <p>$attackerInput</p> Un-encoded: <p><img src=' Encoded: <p>lt;img src='

20. JavaScript String Output Encoding
$attackerInput="\"); alert('gotcha');//" <script> doSomething("$attackerInput"); </script> Unescaped doSomething(""); alert('gotcha');//"); Escaped doSomething("\x22\x29\x3B\x20alert\x28\x27gotcha\x27\x29\x3B\x2F\x2F");

21. What is CSRF?
Cross Site Request Forgery: using the existing browser session to perform a privileged operation the user doesn't intend or expect.

22. Defending Against CSRF
Tokenizer pattern
Built in CSRF protection is included in many frameworks
Double submission
Avoid POST, GET for modifying operations

23. References
OWASP XSS Cheat Sheethttps://
OWASP CSRF Cheat Sheethttps://
OWASP Top 10 - A3 – Cross-Site Scriptinghttps://
OWASP Top 10 - A8 – Cross-Site Request Forgeryhttps://

24. This Week’s Agenda
December 15th: Introduction to AppSec December 16th: Injection December 17th: Vulnerable Authentication & Session Management December 18th: Cross-Site Scripting December 19th: Secure Development Process