You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
|
|
|
|
|
<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>What is XSS? | tait.tech</title> <link rel="stylesheet" href="/assets/css/style.css"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="author" content="Tait Hoyem"> <meta name="keywords" content=""> <meta name="description" content=""> </head> <body> <div id="wrapper"> <header> <nav> <input type="checkbox" id="menu"> <label for="menu">☰</label> <div class="menu-content"> <a href="/" class="nav-link">Home</a> <a href="/blog/" class="nav-link">Blog</a> <a href="https://github.com/TTWNO/" class="nav-link" target="_blank" rel="noopener noreferrer">Github</a> </div> </nav> </header> <main> <article> <header> <h1 class="post-title">What is XSS?</h1> <time datetime="20-04-25" class="post-date">Saturday, April 25 2020</time> </header> <hr> <p>I found a cross-site scripting (XSS) attack in a well-known quiz hosting website. I disclosed the vulnerability to them years ago, so I thought now might be a good time to write about it.</p> <p>In this first article I will explain what XSS is.</p> <p>In the next article I will explain how I found this attack.</p> <h2 id="what-is-cross-site-scripting-xss">What is cross-site scripting (XSS)</h2> <p>Cross-site scripting, XSS for short, is a technique to execute arbitrary Javascript code on a user visiting a website by linking to Javascript code stored on another server.</p> <p>So for example:</p> <p>I have a file on my website called <a href="/assets/js/hacked.js">hacked.js</a>. If I was able to run this javascript file on anybody visiting a certain website <em>that is not mine</em>, this would be called cross-site scripting.</p> <p>Click the above <code class="language-plaintext highlighter-rouge">hacked.js</code> link to view the code I use to “hack” this website. It’s safe, I promise ;)</p> <p>Now, how can we get this code to execute when a user visits this site? To explain, I will start with some of the underlying technologies.</p> <h3 id="escape-characters">Escape Characters!</h3> <p>No, this is not a Sherlock Holmes novel!</p> <p>If we suppose that a website is built with sequences like these (called “tags”): <code class="language-plaintext highlighter-rouge"><body></code>, <code class="language-plaintext highlighter-rouge"><p></code> (for paragraph), <code class="language-plaintext highlighter-rouge"><link></code> and <code class="language-plaintext highlighter-rouge"><b></code> for bold, then why can you <em>see</em> the left and right angle bracket characters? Don’t they mean something? Shouldn’t they be telling the browser: <em>“Hey! Make me bold!”?</em> Why <em>doesn’t</em> everything after me typing <code class="language-plaintext highlighter-rouge"><b></code> turn bold?</p> <p>The answer is:</p> <p>There are special characters in HTML to type a visible left (<) and visible right angle bracket (>) in a website. If I use the left and right brackets on my keyboard however, things will indeed <b>show up bold</b>.</p> <p>This is the code for the sentence I wrote above:</p> <pre class="terminal">
|
|
|
|
|
|
There are special characters in HTML to type a visible left (&lt;)
|
|
|
|
|
|
and visible right angle bracket (&gt;) in a website.
|
|
|
|
|
|
If I use the left and right brackets on my keyboard however,
|
|
|
|
|
|
things will indeed <b>show up bold</b>.
|
|
|
|
|
|
</pre> <p>Notice how all visible left angle brackets use an <code class="language-plaintext highlighter-rouge">&lt;</code> to show them?</p> <p>These are called <a href="https://en.wikipedia.org/wiki/Escape_character">escape characters</a>. They tell a system, in this case your web browser: <em>“Hello! Please show me off! I don’t want to be hidden.”</em></p> <h4 id="sanitization">Sanitization</h4> <p>Most of the time XSS attacks are done using poorly sanitized HTML <code class="language-plaintext highlighter-rouge"><input></code> elements.</p> <p>Sanitization is when a program (usually on the server side), will remove characters like <code class="language-plaintext highlighter-rouge"><</code> and replace them with the aforementioned “escape characters”. Internally this would be something like <code class="language-plaintext highlighter-rouge">&lt;</code>, but they would show up to a user as <code class="language-plaintext highlighter-rouge"><</code>.</p> <p>When inputs are not properly sanitized <em>and</em> the input is shown to the user in another part of the website, then a malicous user can type in HTML that will run whenever anybody tries to look at what they typed. For example: a name for a quiz website (input) and the leaderboard for said quiz (display).</p> <p>HTML, by itself is not very dangerous. The worst thing you could do is probably put a link on your name, and then point it to a porn site. Make your name bold, italic. Maybe make the background a funny color. Although this may annoy your victim it is not dangerous security wise.</p> <p>There is one tag however, that <em>is</em> scary…</p> <h2 id="script"><code class="language-plaintext highlighter-rouge"><script></code></h2> <p>The <code class="language-plaintext highlighter-rouge"><script></code> tag allows you to write code that can:</p> <ol> <li>Change the page contents.</li> <li>Redirect the user to a new page automatically.</li> <li>Get a user’s location.</li> <li>Open a user’s microphone/webcam.</li> <li>With the <code class="language-plaintext highlighter-rouge">src</code> <a href="https://www.w3schools.com/htmL/html_attributes.asp">attribute</a> you can also load a script from another site. (This is XSS)</li> </ol> <p>Those last two will ask for permission from the user (if their browser isn’t insanely insecure).</p> <p>In my next article I’ll talk about a website I found which is vulnerable to this attack. And, show you how you can run your own XSS attack.</p> </article> </main> <hr> <footer> This page is mirrored on <a href="https://beta.tait.tech/2020/04/25/xss/">beta.tait.tech</a>. </footer> </div> </body> </html>
|
