1. Cross-Site Scripting (XSS) Attack Lab
Zutao Zhu
11/10/2009

2. Outline
Basic idea

3. Basic Idea

4. Task 1
Run the code

5. Task 2
Run the code

6. Task 3 Run the code Pay attention to the empty space in the cookie
You can use escape() to delete the space in cookie

7. Task 4 Change the sample code to include cookie into the post data
Use urlConn.addRequestProperty()
Refer to to learn how to install JDK

8. Task 5
Goal: When the victim clicks this post, it will automatically create a post for this victim.
Steps:
Retrieve the session ID of the user using JavaScript.
Forge a HTTP post request to post a message using the session ID.

9. Task 5 Write an XSS worm construct the Http request
find the sid in cookie
construct the content to send, the format of the content can be get from LiveHttpHeader
Send
Try to minimize the size of the script

10. Task 6
To be able to propagate itself, the forged message should also include a worm, so whenever somebody clicks on the forged message, a new forged message that carry the same worm will be created. This way, the worm can be propagated.

11. Task 6 Self-Propagating XSS Worm
making a copy of itself when posting the message
ensuring the message posted is encoded using URL encoding

12. Strategy Uses DOM API for making a copy of itself
Uses the JavaScript function encode() for the purpose of URL encoding
Avoids using the ‘+’ symbol for string concatenation and addition, because URL encoding use ‘+’ to denote a space
Uses absolute values, avoids number manipulation, and the concat() function for string concatenation

13. Note
concat() - Combines the text of two or more strings and returns a new string.