Mighty XSS (Basics of Cross Site Scripting)

Welcome Readers,

In the last post I talked about mXSS. In this post we will cover about XSS type and various XSS attack.
First of all what is XSS and why it is considered so danger and have third place in OWASP top 10. Lets decode this jargon.
As name suggest XSS (Cross Site Scripting) is some form of script/code that attacker use for malicious purpose.Our web applications have multiple input fields like forms, comment box, email, upload field etc etc.
These are the entry points where user suppose to enter valid information. but think as a hacker what if we can write some script/code in the comment box of web application and on posting that comment on site gives some different output than expected.
Take an example there is a bank website and on home page there is search box present to search bank related information on that website.

So first lets play a user role. we will search "bank" word in search box. and lets see what appears,

Okay results as expected web application search box took our query and searched on its website and returned result.This is what normal people do with search box :P

Now lets Play a Hacker role. Instead of putting simple query words lets form a query/script which can actually execute on hitting search button.
Umm! I want my search query result on the separate pop up box then what we need to write in the search box?
to make a popup box we need to write a script so lets write a script,

<script>alert("infinite8security")</script>

Now lets put this code in search box and hit search button and tada!! Our search query is popped in separate popup box.

 

 So thinking ahead what exactly happened when we provided script instead of normal text.

 When we provided normal text as "bank" application search box page code accepted user input and provided search result. Now when we provided <script>...</script> as input search box page code took this input executed <script> tags and provided output.

I hope all above explanation helped you to understand how scripting can be used to trick the web applications and get desired output. but in which cases these script can be considered as malicious or harmful.

• When script has access to some of the user's sensitive information, such as cookies.
• When script can send HTTP requests with arbitrary content to arbitrary destinations by using XMLHttpRequest and other mechanisms.
•  When script can make arbitrary modifications to the HTML of the current page by using DOM (Document Object Model) manipulation methods.

Combining these facts can cause very serious security breaches.
That's all guys hope you have understood basics of cross site scripting. We will discuss more about type of xss and demonstration in next posts.