XSS vulnerabilities
Script injection into a page: stored, reflected and DOM-based XSS; what the attacker gains; output escaping according to context, the CSP policy and the HttpOnly cookie.
- 22 cards
- 4 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
A few cards from the deck
XSS: what is it?
Show the answer
A flaw that lets an attacker have his script run by a victim's browser, in the context of a legitimate site.
The script runs with the site's origin: it reads its unprotected cookies and content, and acts on the victim's behalf. The cause is third-party text written into the page without escaping.
What does this code do when the comment is <img src=x onerror=alert(1)>?
```javascript
document.querySelector("#commentaire").innerHTML = comment;`- It creates an image with no valid source, whose error triggers the script
- It shows the tag's text as is, without interpreting it
- It rejects the value, because innerHTML accepts only text without tags
- It runs the script only if the page is served over HTTP
Show the answer
It creates an image with no valid source, whose error triggers the script
innerHTML parses the string as HTML: the img tag is created, loading x fails and onerror runs. A script tag does not run via innerHTML, but event handlers do. textContent avoids the problem.
In a … XSS, the injected script is saved by the server, for example in a comment, and hits every visitor who displays the page.
Show the answer
In a stored XSS, the injected script is saved by the server, for example in a comment, and hits every visitor who displays the page.
It is the most serious of the three: the victim needs to click nothing special, just view a normal page.
Output escaping: what is it?
Show the answer
Converting a piece of data's special characters when writing it into a page, so that they are read as text and not as code.
It is done at output, at the last moment, because the right transformation depends on where the value is written: HTML text, attribute, URL or script.
An alert pops up for all visitors of a forum after a message was posted. Opening the HTML shows the message written as is, tags included. Which fix fits?
- Forbid messages longer than 200 characters to limit the script
- Switch the forum to HTTPS so the message is encrypted on the way
- Clear each visitor's browser cache
- Escape the message when displaying it, and add a CSP as backup
Show the answer
Escape the message when displaying it, and add a CSP as backup
This is a stored XSS: the dangerous message is in the database and everybody receives it. HTTPS protects the transit, not the content of a page; a length limit does not stop a short script. Output escaping closes the flaw.