Slashdot Mirror
The Anatomy of Cross Site Scripting
LogError writes "Many documents discuss the actual insertion of HTML into a vulnerable script, but stop short of explaining the full ramifications of what can be done with a successful XSS attack. While this is adequate for prevention, the exact impact of cross site scripting attacks has not been fully appreciated. This paper will explore those possibilities."
Do not have a blacklist for denying invalid input. It's hell/impossible to maintain such blacklists
Handle all user input as it was written by satan himself, and only allow input complying to your strict specification.
Cross site scripting (XSS) flaws are a relatively common issue in web application security, but they are still extremely lethal
You better believe it. Why only last week I had one of my web developers executed for writing code vunerable to a Cross Scripting Attack. I dont want any slackers on my team.
PS I now have an opening for an experienced web developer. Sent resumes to spareme@icodetolive.com
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
In high school for economics class we got to play a mock stock martket game (on the web). Well my stock market team consisted of myself and another CS student.
On the website you would enter in the amount of stock, stock symbol, and BUY or SELL in a form. That form would POST to a confirmation page and from there you would click "TRADE" and it would post to some server side page to execute the trade. The fools that designed the site thought it would be a good idea to validate all the data on the confirmation page and NOT on the server side page. We created a local version of the initial confirmation page, changed the action of the form to "http://www.tradingsite.com/cgi-bin/trade.pl". We then proceeded to buy -100000 shares of MSFT for about 40 bucks a pop.
The server had a formula of something like:
(STOCKPRICE * SHARES) + COMMISION = SUM
The sum was then checked against your accounts cash balance.
Something like:
IF (SUM > CASHBALANCE)
ERROR;
ELSE
EXECUTE TRADE;
Well we had a big negative number for our SUM so it passed.
The server then procceeded to:
CASHBALANCE = CASHBALANCE - SUM
Well anyone who has taken 5th grade math knows what happens when you subtract a negative number.
To make a long story short....we come into school about 2 weeks later and there is a big list of all the teams playing the stock market game in NY state. Our team is number 1 by about 2 million bucks, 2nd place is at about 105k. We confessed to whole the thing explained to the site what they did wrong and didn't get in any trouble.
The morale of this story:
Validate all user input before you perform ANY actions with it.