- [Tutor] Cross-site scripting vulnerabilities
have become one of the most common
web applications vulnerabilities out there.
There are three types of cross-site scripting attacks,
Reflected, stored or persistent and DOM-based
cross-site scripting attacks.
Now reflected, I forgot to mention is actually
a nonpersistent attack while stored
as I just mentioned it is a persistent
cross-site scripting condition.
Now another thing that I want to highlight
is that cross site scripting is a flaw in a web application
but the target the victim itself is the user.
So successful exploitation of cross site scripting
can result in many different things,
installation or execution of malicious code,
account compromise, session cookie hijacking,
revelation or modification of local files
or site redirection.
So that means that redirecting the user
to a malicious site or to a site that can be used
to obtain sensitive information from that user.
You typically find cross-site scripting vulnerabilities
in search fields, HTTP headers, input fields
that I call user data,
error messages that return user supplied text,
hidden fields that may include user input data,
or websites or applications that display user supplied data.
Now in this example, I'm actually demonstrating
a quick cross-site scripting tests.
In this case actually I am using a script tag
followed by an alert, right
so I'm going to cause a pop up window
to appear in the window in the screen.
And I'm just typing here Omar was here, right?
Think about that.
This can be actually any malicious code
or even any message to the user, you know,
it can be something like,
"Your authentication has expired,
"please click here to re-login."
And then the user is redirected to another page.
The user, you know, doesn't know better
is entering his users credentials
and then you're actually getting
the user credentials from the user.
Now there are many different attack vectors.
So cross-site scripting vectors out there.
What I did is actually I have a list
of pretty comprehensive list of many different examples
for your reference in the GitHub repository for this class.
Now, let's actually start by actually going over
what is reflected cross-site scripting
the examples of the methods of delivery
and then going over, you know,
store based cross site scripting as well.
So in every flector attack
or non persistent cross-site scripting
is basically when a malicious code or script
are injected by a vulnerable web application
using any methods that use a response
as part of a valid HTTP request.
In this example the user is actually being persuaded
to follow malicious link to a vulnerable server
that injects or reflects the malicious code
to the user's web browser.
And this actually is causing the browser
to execute the code or the script.
The vulnerable server is typically unknown
or a trusted site.
There's an element of social engineering for these attacks,
because you're actually can you persuade the user
to follow that malicious link or mean of course
there's many other examples of deliveries,
like you know, sending phishing emails,
messaging applications, search engines, and many others.
Now let me explain what is stored cross-site scripting
or persistent cross site scripting.
Basically that attack occurs when the malicious code
or the script is permanently stored
on a web vulnerable server or a malicious server.
And basically that is doing that storing data
in a database or a file.
Now this attacks are typically carried out
on websites hosting things like blog post,
forums, and any other permanent storage methods.
An example is whenever FC user
is requesting the story information
from the vulnerable or malicious server,
which causes the injection of the requested
malicious script into the victim's browser.
Now in this type of attack the vulnerable server
is usually a known or a trusted website.
Now in this case, I'm actually using as an example,
you know, the damn vulnerable web application
and navigating to the cross-scripting store exercise,
if you will.
And then in there, I'm actually typing my name
and typing the script alert, Omar was here.
Similar to what you saw before.
And then you know closing the script tag.
And then I'm signing that guestbook
and as you can see, you know a pop up message
is actually you know appearing in the screen
just like you actually saw before.
However the difference here is that
if I navigate out of the page,
and I come back to the same page,
you actually see the pop up message,
you know, again being displayed to the user.
So that is the difference between reflected
which is non persistent and stored,
which actually persistent cross-site scripting.