Skip to main content

Ethical Hacking - Cross-Site Scripting

Cross-site scripting (XSS) is a code injection attack that allows an attacker to execute malicious JavaScript in another user's browser.
The attacker does not directly target his victim. Instead, he exploits a vulnerability in a website that the victim visits, in order to get the website to deliver the malicious JavaScript for him. To the victim's browser, the malicious JavaScript appears to be a legitimate part of the website, and the website has thus acted as an unintentional accomplice to the attacker. These attacks can be carried out using HTML, JavaScript, VBScript, ActiveX, Flash, but the most used XSS is malicious JavaScript.
These attacks also can gather data from account hijacking, changing of user settings, cookie theft/poisoning, or false advertising and create DoS attacks.

Example

Let’s take an example to understand how it works. We have a vulnerable webpage that we got by the metasploitable machine. Now we will test the field that is highlighted in red arrow for XSS.
Metasploitable
First of all, we make a simple alert script
<script>  
   alert(‘I am Vulnerable’)  
</script>
It will produce the following output −
Simple Alert

Types of XSS Attacks

XSS attacks are often divided into three types −
  • Persistent XSS, where the malicious string originates from the website's database.
  • Reflected XSS, where the malicious string originates from the victim's request.
  • DOM-based XSS, where the vulnerability is in the client-side code rather than the server-side code.
Generally, cross-site scripting is found by vulnerability scanners so that you don’t have to do all the manual job by putting a JavaScript on it like
<script>  
   alert('XSS') 
</script>
Burp Suite and acunetix are considered as the best vulnerability scanners.

Quick Tip

To prevent XSS attacks, keep the following points in mind −
  • Check and validate all the form fields like hidden forms, headers, cookies, query strings.
  • Implement a stringent security policy. Set character limitation in the input fields.
Labels:

Comments

Post a Comment

Popular posts from this blog

IMPORTANCE AND ADVANTAGES OF SIWES

STUDENTS INDUSTRIAL WORK EXPERIENCE SCHEME (SIWES) The Industrial Training/Students Industrial Work Experience Scheme, IT/SIWES is a new Directorate under the Vice-Chancellor’s Office.  It was established on 20th April, 2012 The Students Industrial Work Experience Scheme (SIWES) is a skills training programme designed to expose and prepare students of universities and other tertiary institutions for the Industrial Work situation they are likely to meet after graduation.  It is also a planned and structured programme based on stated and specific career objectives which are geared towards developing the occupational competencies of participants (Mafe, 2009).  Consequently, the SIWES programme is a compulsory graduation requirement for all Nigerian university students offering certain courses. The Students Industrial Work Experience Scheme (SIWES), is the accepted training pro...
1 comment
Read more

Animal Cell

 By Lasisi Halima Billy   All animal cells are multicellular. They are eukaryotic cells.  A nimal cells  are surrounded by plasma membrane and it contains the nucleus and organel les that are membrane bound. A nimal cells are of various sizes and have irregular shapes.  Most of the cells size range between 1 and 100 micrometers and are visible only with help of microscope.  Trillions of cells are found in the human body.  There are many different types of cells, approximately 210 distinct cell types in adult human body.   Animal Cell Definition    Animal cells are eukarytoic. Animal cells are have outer boundary known as the plasma membrane.  T he nucleus and the organelles of the cell are bound by a membrane.  The genetic material (DNA) in animal cells...
Post a Comment
Read more

Light Microscope vs Electron Microscope.

Both light microscopes and electron microscopes use radiation (light or electron beams) to form larger and more detailed images of objects (e.g. biological specimens, materials, crystal structures, etc.) than the human eye can produce unaided. (See also: What is eyesight ? ) An electron microscope is a microscope that uses beams of electrons instead of rays of visible light to form highly magnified images of tiny areas materials or biological specimens. Comparing light vs electron microscopes is made more complicated by the fact that there are different types of electron microscopes. The two main types of electron microscope are the Transmission Electron Microscope (TEM) and Scanning Electron Microscope (SEM). Other types of electron microscope include the Scanning Tunneling Microscope (STM) and Field Emission Transmission Microscope (FE-TEM). Brief notes, see the tables lower down this page for figures, explanations and comments: ...
Post a Comment
Read more