Cross Sight scripting: Type-2 By John Gill CSCE 548 Student Presentation

What is Type 2 XSS Clever manipulation of an website vulnerability, primarily html weakness Commonly written in scripting languages, a favorite being JavaScript Unlike XSS type-1, type-2 is stored within a website data base Type 2 is also known as persistent xss or stored xss, hence the necessity for storage in the database It is important to note for an attack to be persistent it is stored on the server side rather than client ²

Who is effected Common xss attacks take place in public domains where “code and data” are mixed ¹ Social engineering is not the culprit Simply visiting a webpage is enough to be infected Forums, blogs, comment sections

What is impacted Large database of unprotected or unfiltered input Unsuspecting people visiting a webpage, even if it is a common occurrence Social media is a common target for exploitation Confidentiality is breached Cookie and data theft common targets

fundamentals of a XSS type-2 attack Malicious code input webpage obtains malicious code Malicious code is executed Database Diagram 1: 24 Deadly sins

Notable Type-2 exploits and repercussions Samy worm ² Myspace, exploit Myspace was in the infancy of developing xss safeguards, obviously they still have some work to do When the profile was viewed the worm required: User to add samy sent a pop-up infected the individual This was the fastest spreading worm of its time infecting at an exponential rate

Detection of type-2 One of the basic techniques is testing a websites input parameters ¹ Understanding that the raw data must be viewed is of absolute importance scanning code for common scripting characters is an easy way to review large amounts of data quickly Common symbols include: <, >, %, =, ‘, “, &, and request commands Common tools in finding vulnerabilities include: Nikto Nexxus

Prevention ³ Rule 1: An escape from the aforementioned symbols ³ Assume all data is malicious and thus untrusted Rule 2: Encoding 4 This is why looking at raw data is important, converting foreign symbols into entities renders the malicious code in-executable Rule 3: Include HTML code within application 4 After converting user input into an entity, html code should be used to further this process, to hash, clean, and return a cleaned integer value for the compiler to express in terms of legible word

Conclusion Prevention of cross Site scripting is a matter of basic html capacity and the more advanced practices in preventing certain functionalities. In order for websites commonly under attack such as Myspace as well as facebook, google, and whom ever it is a matter of safeguarding. Xss is easily preventable in the realm of webpages so long as developers understand the necessity for prevention rather than patching. Fixing an issue presented to you is easy, forward thinking while, a hassle, can save you your job, and tens of thousands of clients in the future with proper precautionary testing.

References Howard, Michael, David LeBlanc, and John Viega. 24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them. New York: McGraw-Hill, 2010. Print. Auger, Robert. "Cross Site Scripting." The Web Application Security Consortium. The Web Application Security Consortium, n.d. Web. XSS (Cross Site Scripting) Prevention Cheat Sheet. Open Web Application Security Project, n.d. Web. "Prevent Cross-site Scripting Attacks by Encoding HTML Responses." Prevent Cross- site Scripting Attacks by Encoding HTML Responses. IBM, n.d. Web. 20 July 2016.