用FireFox的插件XSS Me来检测网站代码的XSS问题

简介:

又是PCI COMPLIANCE的事,改进之后,先自测。

https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29

Cross-Site Scripting (XSS) attacks occur when:

  1. Data enters a Web application through an untrusted source, most frequently a web request.
  2. The data is included in dynamic content that is sent to a web user without being validated for malicious code.

The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash or any other type of code that the browser may execute. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data like cookies or other session information to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site.

Stored and Reflected XSS Attacks

XSS attacks can generally be categorized into two categories: stored and reflected. There is a third, much less well known type of XSS attack called DOM Based XSS that is discussed seperately here.

Stored XSS Attacks

Stored attacks are those where the injected code is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information.

Reflected XSS Attacks

Reflected attacks are those where the injected code is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other web server. When a user is tricked into clicking on a malicious link or submitting a specially crafted form, the injected code travels to the vulnerable web server, which reflects the attack back to the user’s browser. The browser then executes the code because it came from a "trusted" server.

XSS Attack Consequences

The consequence of an XSS attack is the same regardless of whether it is stored or reflected (or DOM Based). The difference is in how the payload arrives at the server. Do not be fooled into thinking that a “read only” or “brochureware” site is not vulnerable to serious reflected XSS attacks. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. The most severe XSS attacks involve disclosure of the user’s session cookie, allowing an attacker to hijack the user’s session and take over the account. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirect the user to some other page or site, or modify presentation of content. An XSS vulnerability allowing an attacker to modify a press release or news item could affect a company’s stock price or lessen consumer confidence. An XSS vulnerability on a pharmaceutical site could allow an attacker to modify dosage information resulting in an overdose.

How to Determine If You Are Vulnerable

XSS flaws can be difficult to identify and remove from a web application. The best way to find flaws is to perform a security review of the code and search for all places where input from an HTTP request could possibly make its way into the HTML output. Note that a variety of different HTML tags can be used to transmit a malicious JavaScript. Nessus, Nikto, and some other available tools can help scan a website for these flaws, but can only scratch the surface. If one part of a website is vulnerable, there is a high likelihood that there are other problems as well.

How to Protect Yourself

The primary defenses against XSS are described in the OWASP XSS Prevention Cheat Sheet.

Also, it's crucial that you turn off HTTP TRACE support on all webservers. An attacker can steal cookie data via Javascript even when document.cookie is disabled or not supported on the client. This attack is mounted when a user posts a malicious script to a forum so when another user clicks the link, an asynchronous HTTP Trace call is triggered which collects the user's cookie information from the server, and then sends it over to another malicious server that collects the cookie information so the attacker can mount a session hijack attack. This is easily mitigated by removing support for HTTP TRACE on all webservers.

The OWASP ESAPI project has produced a set of reusable security components in several languages, including validation and escaping routines to prevent parameter tampering and the injection of XSS attacks. In addition, the OWASP WebGoat Project training application has lessons on Cross-Site Scripting and data encoding.

Alternate XSS Syntax

XSS using Script in Attributes

 

目录
相关文章
|
11月前
|
存储 前端开发 JavaScript
渗透实战:某文库网站XSS盲打
渗透实战:某文库网站XSS盲打
97 0
|
Web App开发
FireFox 32不支持64位的NPAPI dll插件
FireFox 32不支持64位的NPAPI dll插件
97 0
|
Web App开发 Linux 内存技术
FireFox 64位不支持NPAPI插件,不论是32位还是64位
FireFox 64位不支持NPAPI插件,不论是32位还是64位
172 0
|
Web App开发 Windows
WINDOWS下测试NPAPI插件,请使用FireFox 49版本
WINDOWS下测试NPAPI插件,请使用FireFox 49版本
244 0
|
Web App开发 Windows
Windows下FireFox插件dll文件名,必须是np开头,不能是plugin结尾
Windows下FireFox插件dll文件名,必须是np开头,不能是plugin结尾
70 0
|
Web App开发 Windows
WINDOWS下FireFox插件没有固定目录
WINDOWS下FireFox插件没有固定目录
64 0
|
Web App开发
新版FireFox使用NPAPI插件的办法
新版FireFox使用NPAPI插件的办法
1143 0
|
Web App开发 Java Linux
LINUX开发FIREFOX的插件:编译npruntime
LINUX开发FIREFOX的插件:编译npruntime
118 0
|
Web App开发 网络安全
Firefox 屏蔽中国大陆用户安装 uBlock Origin 等广告拦截插件
Firefox 屏蔽中国大陆用户安装 uBlock Origin 等广告拦截插件
443 0
Firefox 屏蔽中国大陆用户安装 uBlock Origin 等广告拦截插件
|
Web App开发
kali机中firefox浏览器装hackbar插件
kali机中firefox浏览器装hackbar插件
567 0
kali机中firefox浏览器装hackbar插件