Skip to main content

[ Preventing XSS attacks ]

[ Preventing XSS attacks ] 

In the video it illustrates three version of an XSS attack: high level, detailed with the script tag, and detailed with no script tag, and then recommends resources for further learning. 
Cross-site scripting holes are web-application vulnerabilities which allow attackers to bypass client-side security mechanisms normally imposed on web content by modern browsers. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access privileges to sensitive page-content, session cookies, and a variety of other information maintained by the browser on behalf of the user.

Cross-Site Scripting (XSS) attacks occur when:
  1. Data enters a Web application through an untrusted source, most frequently a web request.
  2. The data is included in dynamic content that is sent to a web user without being validated for malicious code.
The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash or any other type of code that the browser may execute. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data like cookies or other session information to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site.

The XSS attacks are in two categories.


Stored XSS Attacks

Stored attacks are those where the injected code is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information.

Reflected XSS Attacks

Reflected attacks are those where the injected code is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other web server. When a user is tricked into clicking on a malicious link or submitting a specially crafted form, the injected code travels to the vulnerable web server, which reflects the attack back to the user’s browser. The browser then executes the code because it came from a "trusted" server.
 


The site OWASP offers a great way to protect your site from a XSS attack.

OWASP XSS Cheat Sheet

Comments

Post a Comment

Popular posts from this blog

Learning Linux

Learning linux from the ground up is really a challenge. As you progress even more you start customizing your OS from how it starts and how it shutdown. As soon as you start on a Live CD your x server is pretty much either gnome or KDE. I mean it looks easy to do, but as soon as you start research how the x server it can get trick. My recommendation is to also learn the bash line or command prompt. if your good with the line commands then reconfiguring your computer shouldn't be a problem, but you just learn the GUI layer of it and not the line commands believe me your going to have hard time restoring your computer. As I ask people around they say linux is hard to install. The easiest way to partition your drive manually is like this. sda1 /home -- This is where you want to store all your data in case your linux gets corrupted. This space can be as big as you want sda2 /swap -- Linux is just like windows it needs it virtual space. The swap size depends on your physical ram.
4 comments
Read more

DTS OS Enterprise

Well here are screen-shots of the OS images that I am making. The Desktop Environment is KDE The web browser is Firefox with a simple theme in place. Overall DTS OS Enterprise has two versions and it was made for especially for the acer aspire one netbooks. The OS should work with other computers since it is Linux. Some of the network icons are going to replace with custom icons.    Different Edition s Network Security Restoration Edition  File name: DTS-NS.iso File size: 200 - 300 MB The release date is going to be sometime in the late spring 2010.
Post a Comment
Read more

Netwars Competition

The NetWars game is a collection of computer and network security challenges. It is designed to represent real-world security issues: their flaws and their resolutions. Each player can follow an independent path based on individual problem solving skills, technical skills, aptitude, and creativity. The game is played in a fun but safe environment using the technology that drives our lives every day. The game starts when a player downloads and starts a CD-ROM image on a PC or in a virtual environment such as VMware Player. The image contains a brief tutorial and the game's full instructions. The player must find a hidden key within the image that is downloaded and then uses that key to enter an online environment where knowledge of security vulnerabilities and their exploits can be turned into points. Upcoming Competitions   June 18-20, 2010 PST September 17-19, 2010 November 5-7, 2010 December 17-19, 2010 April 29 - May 1, 2011 Click Here to read more
2 comments
Read more