XSS to beginners. The Purpose of XSS Attacks
Greetings, dear visitors of the Portal!
I want to tell you about the purpose of XSS attacks, since XSS vulnerabilities present a much greater danger than simply stealing cookies.
About everything in order ...
First about XSS in general. The abbreviation XSS stands for Cross Site Script ("crossite scripting"). It is accepted to call it XSS, not CSS, since the CSS was introduced much earlier, and it means Сasсading Style Sheets - "cascading style sheets" (used in the design of HTML-pages). Cross is a "cross", so the first letter in "cross-site scripting" is replaced with "X".
XSS is a vulnerability on the server that allows you to inject an arbitrary HTML code into the HTML page generated by the scripts on the server (not in the script, unlike PERL or PHP inlining) by passing it as the value of an unfiltered variable. An "unfiltered" variable means a variable that, before it is used in a script (for example, PHP), is not checked for forbidden characters, such as:,,, and many others. First, the value of the variable is transferred from the HTML page loaded in the user's browser to the php script (via the POST or GET request). The POST request passes variables through an array that is not displayed in the address bar of the browser; The GET request detects itself in the address bar as follows:
http://www.hackzona.ru/hz.php?name=News&file=artiсle&sid=3499&mode=&order=0&thold=0 So, the hz.php script will be passed variables:
$ name - with the value "News",
$ file - with the value "artiсle",
$ sid - with a value of "3499" et ...
Naturally, it is more convenient to work with GET-requests, therefore, the hacker saves the page of the hacked site and in the line, like:
FОRМ АСTION="http://www.hackzona.ru/hz.php" METHOD=РOST POST replaces with GET. Next npp-script, for example, generates an HTML-page, in which displays the value of one of the transferred variables without any filtering. BUT! If an attacker, when composing a GET request, substitutes some key tags for the variable (for example,
or <BR>), then they are executed by the interpreter!
So it was fixed that the majority of computer hooligans use XSS only to steal cookies (cookies - in most cases they store a session, assigning to itself which an attacker can be on a site under another's account, for example, in a forum where registration is desirable.) They also store encrypted password, decrypting which, the hooligan will be able to seize the account by 100%). But XSS-bugs are not limited to stealing cookies.
Actually, the climax paragraph .
What do XSS vulnerabilities allow us to do?
1) All kinds of "podlyanki" associated with limiting users to normal activities on the site. For example, the output of an infinite number of windows (example below) or messages (the confirm or alert method) as a result of some user action (clicking, hovering over an object, just entering the site). Or redirect to another node. Try to implement this code (without changes) in the vulnerable site:
<Нtml> *** оdy>Нtml> and open it in any browser.
2) Theft of confidential visitor information. First of all, here I will take the theft of cookies (doçument.cookie) as the most important user security attribute (in this section). Also in this section is the theft of information about the user's system and browser (navigator object, current time, IP address, as well as the history of visited sites (the history object as an array, current history , previous history [-1], total pages history.length) and much more. Here is an example of a script that returns the IP address of a visitor to the IP variable and the computer name in the host variable (checked in Oracle, Mozilla, Mizilla Firefox):
4) Unanticipated by the standard of the browser capabilities. There are many vulnerabilities in browsers that, when processing any code, either call DoS, or grant access to certain files, or allow arbitrary code to be executed on the user's system, or something that is not very pleasant for the user. A lot of well-known and often used browsers (Internet Exlorer, Netscare, Mozilla, Mozilla Firefox, Orera and everything that is created on their engines) is vulnerable. Only some of their versions or patched browsers are invulnerable. Quite recently (at the time of this writing) Benjamin Tobias Franz discovered a critical vulnerability of the Internet Explorer (v5.5, 6.0) browser, which allows executing arbitrary code in the user's system. How can I execute arbitrary code from a user who logs on to a site that has an XSS vulnerability? We'll exploit an exploit written by Stuart Person (you can take it from here: myphp4.h15.ru/0day-explorer.rar or from sesuritylab.ru), which consists of four htm and one html-file, to our server, for example, cooolhacker. yo. In a vulnerable site, implement the following code
That's all I would like to share with you at the moment. As you can see, the possibilities of XSS-attacks are very high. You can arrange mass jokes and podlyanki, steal information and confidential data and even build whole botnets, zombifying site visitors! XSS-bugs will always be, since they endanger the site visitors first, but not the server; and the administration has little incentive to correct these mistakes. Everything, I have finished
All signs "less" and "more" are replaced respectively by "<" and ">".