1. Cross Site Scripting (XSS)
Charles Frank
Northern Kentucky University

2. Cross-Site Scripting (XSS)
Attacker causes a legitimate web server to send user executable content (Javascript, Flash ActiveScript) of attacker’s choosing.
XSS used to obtain session ID for
Bank site (transfer money to attacker)
Shopping site (buy goods for attacker)
Key ideas
Attacker sends malicious code to server.
Victim’s browser loads code from server and runs it.
March 4, 2009
SIGCSE

3. Vulnerability Trends for 2006
Trend data from MITRE CWE.
March 4, 2009
SIGCSE

4. Anatomy of an XSS Attack
User logs into legitimate site.
Site sends user authentication cookie.
Attacker sends user XSS attack containing injected code.
User clicks on XSS link in , web, IM.
Browser contacts vulnerable URL at legitimate site with cookie in URL.
Legitimate site returns injected code in web page.
Browser runs injected code, which accesses evil site with cookie in URL.
Evil site records user cookie.
Attacker uses cookie to authenticate to legitimate site as user.
March 4, 2009
SIGCSE

5. XSS Example Client browser sends an error message to the web server.
+error+occurred
March 4, 2009
SIGCSE

6. XSS Example
The error message is “Reflected” back from the Web server to the client in a web page.
<p>Sorry, an error occurred.</p>
March 4, 2009
SIGCSE

7. XSS Example We can replace the error with JavaScript
March 4, 2009
SIGCSE

8. Proof of Concept
March 4, 2009
SIGCSE

9. Exploiting the Vulnerability
User logins in and is issued a cookie
Attacker feed the URL to user
March 4, 2009
SIGCSE

10. Exploiting the Vulnerability
The server responds by sending the user a web page that runs the Java script.
The code makes a request to attacker.com containing the session token.
March 4, 2009
SIGCSE

11. Exploiting the Vulnerability
The attacker monitors requests to attacker.com.
He uses the captured session token to gain access to the user’s personal information and perform actions as the “user”.
March 4, 2009
SIGCSE

12. Email Snare From: “Example Customer Services” To: “J Q Customer”
Dear Valued Customer,
You have been selected to participate in our customer survey. Please complete our easy 5 question survey, and return we will credit $5 to your account.
March 4, 2009
SIGCSE

13. Snare
To access the survey, please log in to your account using your usual bookmark, and then click on the following link:
March 4, 2009
SIGCSE

14. Reassuring
The link contains the correct domain name (unlike phishing).
The URL has been obfuscated
It uses https
March 4, 2009
SIGCSE

15. Reflected XSS Reflected XSS
Injected script returned by one-time message.
Requires tricking user to click on link.
Non-persistent. Only works when user clicks.
March 4, 2009
SIGCSE

16. Anatomy of an XSS Attack
Web Server
8. Attacker hijacks user session.
1. Login
Attacker
User
2. Cookie
5. XSS URL
3. XSS Attack
6. Page with injected code.
7. Browser runs
injected code.
4. User clicks on XSS link.
Evil site saves ID.
March 4, 2009
SIGCSE

17. XSS URL Examples
March 4, 2009
SIGCSE

18. Stored XSS Stored XSS Injected script stored in comment, message, etc.
Requires ability to insert malicious code into web documents (comments, reviews, etc.)
Persistent until message deleted.
March 4, 2009
SIGCSE

19. Stored XSS
Auction site that allows buyers to post questions and sellers to post responses.
If an attacker can post a question containing a script, the attacker could get a user to bid without intending to or get the seller to close the auction and accept the attacker’s low bid.
March 4, 2009
SIGCSE

20. Why does XSS Work? Same-Origin Policy Vulnerable Server Program
Browser only allows Javascript from site X to access cookies and other data from site X.
Attacker needs to make attack come from site X.
Vulnerable Server Program
Any program that returns user input without filtering out dangerous code.
March 4, 2009
SIGCSE

21. XSS Attacks MySpace worm (October 2005) Paypal (2006) BBC, CBS (2006)
When someone viewed Samy’s profile:
Set him as friend of viewer.
Incorporated code in viewer’s profile.
Paypal (2006)
XSS redirect used to steal money from Paypal users in a phishing scam.
BBC, CBS (2006)
By following XSS link from securitylab.ru, you could read an apparently valid story on the BBC or CBS site claiming that Bush appointed a 9-year old as head of the Information Security department.
March 4, 2009
SIGCSE

22. Impact of XSS Attackers can hijack user accounts.
Attackers can hijack admin accounts too.
Attacker can do anything a user can do.
Difficult to track down source of attack.
March 4, 2009
SIGCSE

23. Mitigating XSS Disallow HTML input Allow only safe HTML tags
Filter output
Replace HTML special characters in output
ex: replace < with < and > with >
also replace (, ), #, &
Tagged cookies
Include IP address in cookie and only allow access to original IP address that cookie was created for.
March 4, 2009
SIGCSE

24. XSS Problem
XSS is a complex problem that is not going away anytime soon.
The browser is insecure by design.
It understand JavaScript.
It isn’t the browsers job to determine what code is good or bad.
Disabling scripting seriously dampens the user’s browsing experience.
March 4, 2009
SIGCSE

25. Cross-Site Scripting Demo
March 4, 2009
SIGCSE

26. OWASP WebGoat
WebGoat 5.2 Standard
WebGoat 5.2 Developer
Run webgoat.bat to start Tomcat
Enter in your browser
March 4, 2009
SIGCSE

27. OWASP WebGoat Username: guest Password: guest Start WebGoat
March 4, 2009
SIGCSE

28. Reflected XSS Attacks Solution: View Page Source
Enter <script>alert('Bang!')</script> for the PIN value
View Page Source
Edit | Find | Bang
March 4, 2009
SIGCSE

29. Stage 6: Blocked Reflected XSS
You have to edit org.owasp.webgoat.lessons.CrossSiteScripting.FindProfile.java. Alter the method getRequestParameter. The body of the mehtod should look something like this:
March 4, 2009
SIGCSE

30. Stage 6: Blocked Reflected XSS
String regex = "[\\s\\w-,]*"; String parameter = s.getParser().getRawParameter(name); Pattern pattern = Pattern.compile(regex); validate(parameter, pattern); return parameter;
March 4, 2009
SIGCSE

31. Stage 1: Stored XSS First Login as Tom with tom as password.
Select Tom from the list and click on the View Profile Button. Now should appear Tom's Profile.
March 4, 2009
SIGCSE

32. Stage 1: Stored XSS
Click on the 'Edit Profile' Button and try an XSS attack on the street field. For example: <script>alert("Got Ya");</script>
Click on the UpdateProfile Button and Log out.
March 4, 2009
SIGCSE

33. Stage 1: Stored XSS
Now log in as Jerry with jerry as password. Select from the the list the profile of tom and hit the ViewProfile Button.
March 4, 2009
SIGCSE

34. Stage 2: Blocked Stored XSS using Input Validation
Solution: You have to alter the method parseEmployeeProfile in the class UpdateProfile.java which is placed in the package org.owasp.webgoat.lessons.CrossSiteScripting The place to code is marked!
March 4, 2009
SIGCSE

35. Stage 2: Blocked Stored XSS using Input Validation
String regex = "[\\s\\w-,]*"; String stringToValidate = firstName+lastName+ssn+title+phone+address1+address2+ startDate+ccn+disciplinaryActionDate+ disciplinaryActionNotes+personalDescription; Pattern pattern = Pattern.compile(regex); validate(stringToValidate, pattern);
March 4, 2009
SIGCSE

36. Stage 2: Blocked Stored XSS using Input Validation
This validation allows following: \s = whitespace: \t\n\x0B\f\r \w = word: a-zA-Z_0-9 and the characters - and ,
Use of any other character will throw a Validation Exception.
March 4, 2009
SIGCSE

37. Stage 3: Stored XSS Revisted
Log in as David with david as password. Choose Bruce from the List and click on the 'ViewProfile' Button.
March 4, 2009
SIGCSE

38. Stage 4: Blocked XSS using Output Encoding
You have to use a static method called encode(String s) which is part of the class org.owasp.webgoat.util.HtmlEncoder.
This method changes all special characters in the string.
Now you have to use this method in the getEmployeeProfile method in the org.owasp.webgoat.lessons.CrossSiteScripting class. Replace all answer_results.getString(someString) with HtmlEncoder.encode(answer_results.getString(someString)) and you are done.
March 4, 2009
SIGCSE

39. XSS References
March 4, 2009
SIGCSE