Computer Security Course. Dawn Computer Security Course. Dawn Song Song Web Security: Vulnerabilities & Attacks Dawn Song
Cross-site Scripting Dawn Song
What is Cross-site Scripting (XSS)? • Vulnerability in web application that enables attackers to inject client-side scripts into web pages viewed by other users. Dawn Song
T ype 2 T ype 1 T ype 0 Three T ypes of XSS • Type 2: Persistent or Stored – The attack vector is stored at the server • T ype 1: Refmected – The attack value is ‘refmected’ back by the server • T ype 0: DOM Based – The vulnerability is in the client side code Dawn Song
T ype 2 T ype 1 T ype 0 Consider a form on safebank.com that allows a user to chat with a customer service associate. SAFEBANK login passwor d c A counts Bill P ay Mail T ransfers banking content User 1. User asks a question via HTTP POST (message: “How do I get a loan?”) Server Dawn Song
T ype 2 T ype 1 T ype 0 Consider a form on safebank.com that allows a user to chat with a customer service associate. SAFEBANK login passwor d c A counts Bill P ay Mail ransfers T banking content User 1. User asks a question via HTTP POST (message: “How do I get a loan?”) 2. Server stores question in Server database. Dawn Song
T ype 2 T ype 1 T ype 0 Consider a form on safebank.com that allows a user to chat with a customer service associate. SAFEBANK login passwor d c A counts Bill P ay Mail ransfers T banking content User 3. Associate SAFEBANK login passwor d requests A ccounts Bill Pay Mail T ransfers banking content Associ the ate 1. User asks a questions question via page HTTP POST (message: “How do I get a loan?”) 2. Server stores question in Server database. Dawn Song
T ype 2 T ype 1 T ype 0 Consider a form on safebank.com that allows a user to chat with a customer service associate. SAFEBANK login passwor d c A counts Bill P ay Mail T ransfers banking content User 3. Associate SAFEBANK login passwor d 4. Server requests A ccounts Bill Pay Mail T ransfers retrieves banking content Associ the ate 1. User asks a all questions question via questions page from the HTTP POST (message: “How do I get a DB loan?”) 2. Server stores question in Server database. Dawn Song
T ype 2 T ype 1 T ype 0 PHP CODE: <? echo "<div class=’question'> $question </div>";?> SAFEBANK login passwor d HTML Code: <div class= ’question' > ”How do I get a loan?” </div> c A counts Bill P ay Mail ransfers T banking content User 3. Associate SAFEBANK login passwor d 4. Server requests A ccounts Bill Pay Mail T ransfers retrieves banking content Associ the ate 1. User asks a all questions question via questions page from the HTTP POST (message: “How do I get a DB 5. Server loan?”) returns HTML 2. Server stores embedded with question in the question Server database. Dawn Song
T ype 2 T ype 1 T ype 0 PHP CODE: <? echo "<div class=’question'> $question </div>";?> SAFEBANK login passwor d HTML Code: <div class= ’question' > ”How do I get a loan?” </div> A c counts Bill P ay Mail ransfers T banking content User 3. Associate SAFEBANK login passwor d 4. Server requests A ccounts Bill Pay Mail T ransfers retrieves banking content Associ the ate 1. User asks a all questions question via questions page from the HTTP POST SAFEBA (message: “How do I get a DB 5. Server loan?”) NK Customer 5: returns HTML “How do I get a loan?” 2. Server stores embedded with question in the question Server database. Dawn Song
T ype 2 T ype 1 T ype 0 T ype 2 XSS Injection Look at the following code fragments. Which one of these could possibly be a comment that could be used to perform a XSS injection? a. '; system('rm –rf /'); b. rm –rf / c. DROP TABLE QUESTIONS; d. <script>doEvil()</script> Dawn Song
T ype 2 T ype 1 T ype 0 Script Injection Which one of these could possibly be a comment that could be used to perform a XSS injection? a. '; system('rm –rf /'); b. rm –rf / c. DROP TABLE QUESTIONS; d. <script>doEvil()</script> <html><body> ... <div class=‘question’> <script>doEvil()</script> </div> ... </body></html> Dawn Song
T ype 2 T ype 1 T ype 0 Stored XSS 1. Attacker asks malicious question via HTTP POST ( message: “<script>doEvil()</script>” ) Server Dawn Song
T ype 2 T ype 1 T ype 0 Stored XSS 1. Attacker asks malicious question via HTTP POST ( message: “<script>doEvil()</script>” ) 2. Server stores Server question in Dawn Song
T ype 2 T ype 1 T ype 0 Stored XSS 3. Victim requests SAFEBANK login passwor d the A ccounts Bill Pay Mail T ransfers banking content Associ questions ate 1. Attacker asks page malicious question via HTTP POST ( message: “<script>doEvil()</script>” ) 2. Server stores Server question in Dawn Song
T ype 2 T ype 1 T ype 0 Stored XSS 3. Victim requests SAFEBANK login passwor d the 4. Server A ccounts Bill Pay Mail T ransfers banking content Associ questions retrieves ate 1. Attacker asks page malicious malicious question question via HTTP POST from the DB ( message: “<script>doEvil()</script>” ) 2. Server stores Server question in Dawn Song
T ype 2 T ype 1 T ype 0 Stored XSS PHP CODE: <? echo "<div class=’question'> $question </div>";?> HTML Code: <div class= ’question' > <script>doEvil()</script> </div> 3. Victim requests SAFEBANK login passwor d the 4. Server A ccounts Bill Pay Mail T ransfers banking content Associ questions retrieves ate 1. Attacker asks page malicious malicious question question via HTTP POST from the DB 5. Server returns ( message: “<script>doEvil()</script>” ) HTML embedded 2. Server with malicious stores question Server question in Dawn Song
T ype 2 T ype 1 T ype 0 Stored XSS PHP CODE: <? echo "<div class=’question'> $question </div>";?> HTML Code: <div class= ’question' > <script>doEvil()</script> </div> 3. Victim requests SAFEBANK login passwor d the 4. Server A ccounts Bill Pay Mail T ransfers banking content Associ questions retrieves ate 1. Attacker asks page malicious malicious question question via HTTP POST from the DB SAFEBA 5. Server returns ( message: NK “<script>doEvil()</script>” ) Customer 5: HTML embedded 2. Server with malicious stores question Server question in Dawn Song
T ype 2 T ype 1 T ype 0 Three T ypes of XSS • T ype 2: Persistent or Stored – The attack vector is stored at the server • Type 1: Refmected – The attack value is ‘refmected’ back by the server • T ype 0: DOM Based – The vulnerability is in the client side code Dawn Song
T ype 2 T ype 1 T ype 0 Example Continued: Blog • safebank.com also has a transaction search interface at search.php safebank.com/search.php?query=chocolate • search.php accepts a query and shows the SAFEBA results, with a helpful message at the top. NK Your query chocolate returned 81 results. <? echo “Your query $_GET['query'] returned (results) $num results.";?> Example: Your query chocolate returned 81 results. • What is a possible malicious URI an attacker could use to exploit this? Dawn Song
T ype 2 T ype 1 T ype 0 T ype 1: Refmected XSS A request to “search.php?query=<script>doEvil()</script>” causes script injection. Note that the query is never stored on the server, hence the term 'refmected' PHP Code: <? echo “Your query $_GET['query'] returned $num results.";?> HTML Code: Your query <script>doEvil()</script> returned 0 results But this only injects code in the attacker’s page. The attacker needs to inject code in the user’s page for the attack to be efgective. Dawn Song
T ype 2 T ype 1 T ype 0 Refmected XSS 1. Send Email with malicious link safebank.com/search.php?query=<script>doEvil()</script> (email client) User Vulnerable Server Dawn Song
T ype 2 T ype 1 T ype 0 Refmected XSS 1. Send Email with malicious link safebank.com/search.php?query=<script>doEvil()</script> 2. Click on Link with malicious params (email client) User Vulnerable Server Dawn Song
T ype 2 T ype 1 T ype 0 Refmected XSS Your query 1. Send Email <script>doEvil()</script> with malicious link returned 0 results safebank.com/search.php?query=<script>doEvil()</script> 3. Server inserts malicious params into HTML 2. Click on Link with malicious params (email client) User Vulnerable Server Dawn Song
Recommend
More recommend
