© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 1 RubyJax Brent Morris/ May 14, 2015 Fortify on Demand XSS Demo

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 2 wat:~ inkrypto$ whoami got some certs CoWrote a MSF Modules Will be helping teach: 15/training/advanced-infrastructure- hacking.html

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 3 Cross-site scripting ('XSS’) is an attack that takes advantage of a Web site vulnerability in which the site displays content that includes un-sanitized user-provided data.

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 4

5 By default, in Rails 3.0 protection against XSS comes as the default behavior. When string data is shown in views, it is escaped prior to being sent back to the browser. This goes a long way, but there are common cases where developers bypass this protection.

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 6 Mutillidae Google XSS game Beef

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 7 Mutillidae Blog Example Owasp Top 10

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 8 Google XSS Game XSS As Google say, "Cross-site scripting (XSS) bugs are one of the most common and dangerous types of vulnerabilities in Web applications. These nasty buggers can allow your enemies to steal or modify user data in your apps…” Level 1 – Our input will be directly included in the page without proper escaping.

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 9 XSS Google game Level 2 – This exercise is an example of how to perform stored Cross-Site Scripting attack.

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 10 XSS Google game Level 3 – This exercise is a little complex because the user doesn't have an input to try to exploit the XSS. What happens if we rewrite the URI? If

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 11 XSS Google game Level 4 – This exercise is similar to the previous one (Exercise 3). The main difference is that now, we have an input. It is expected that a number will be typed into the box, but... what will happen if we write a name instead of typing a number?

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 12 3');alert('RubyJax Gets executed as <img src=“/static/loading onload=“startTimer(‘3’);alert(‘RubyJax’);”

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 13 XSS Google game Level 5 – I don't know what the reason for looking at "next=confirm" was at first because logic would dictate that the first attempt would be to try to exploit a XSS vulnerability in the input field… – next=javascript:alert(”RubyJax")

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 14 XSS Google game Level 6 – The fourth hit says: "If you can't easily host your own evil JS file, see if google.com/jsapi?callback=foo will help you here.” – If we change "foo" for "alert" will have included in its code: – So, if we use the link below, we can exploit the vulnerability.”

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 15 So what’s the big deal? Glad you ask.

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 16 XSS with some Hot Beef Injection!!! Mutillidae Beef – Browser Exploitation Framework

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 17 © Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Something Smells These are examples of how NOT to do it!

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 18 © Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Unfortunately, any field that uses raw input like the last slide will be a potential XSS target. Note that there are also widespread misunderstandings about html_safe. Other tags that change the way strings are prepared for output can introduce similar issues, including content_tag. If you must accept HTML content from users, consider a markup language for rich text in an application (Examples include: markdown and textile) and disallow HTML tags. This helps ensures that the input accepted doesn’t include HTML content that could be malicious. If you cannot restrict your users from entering HTML, consider implementing content security policy to disallow the execution of any javascript. And finally, consider using the #sanitize method that let's you whitelist allowed tags. Be careful, this method has been shown to be flawed numerous times and will never be a complete solution.

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 19 © Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. An often overlooked XSS attack vector is the href value of a link: contains a link that starts with “javascript:”, the content will execute when a user clicks the generated link:

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 20 Defense OWASP Ruby on Rails Cheatsheet Combination of Whitelist and Blacklist Use Frameworks like Angular, React NEVER TRUST USER INPUT!

© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. 21 © Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The End