Educator: Cross-Site Scripting. 2 2
In this lesson, 3 3
we are going to talk about cross-site scripting. 4 4
Now, cross-site scripting is also known as XSS. 5 5
Now, cross-site scripting is a malicious script 6 6
that's hosted on the attacker site 7 7
or coded in a link that's injected onto a trusted site 8 8
designed to compromise clients 9 9
that are browsing that trusted site, 10 10
thereby, circumventing the browser security model 11 11
of trusted zones. 12 12
Essentially, we're trying to get you to click on something 13 13
or run some kind of script 14 14
that your system doesn't want to do. 15 15
We're tryna bypass your security. 16 16
Now, when we talk about cross-site scripting, 17 17
I want you to remember 18 18
cross-site scripting is a powerful input validation exploit. 19 19
So what does that mean? 20 20
It means to protect yourself from this, 21 21
you need to do input validation. 22 22
If you're not doing proper input validation, 23 23
you are going to fall victim to a cross-site scripting attack. 24 24
Now, how does this really work in the real world? 25 25
Well, there's really four steps 26 26
to a cross-site scripting attack. 27 27
Now, in its most basic form, 28 28
the first step of a cross-site scripting attack 29 29
is for the attacker to identify 30 30
input validation vulnerabilities within a trusted website. 31 31
So, let's say they find my website 32 32
and they find out that when I'm taking input 33 33
into my username and password for you to log in, 34 34
I'm not validating that data. 35 35
That would make it a good candidate 36 36
for cross-site scripting. 37 37
Then, they go into Step 2 38 38
which is where the attacker's going to craft a URL 39 39
to perform code injection against that trusted website. 40 40
Now, while they're in this Step Number 2, 41 41
they're also going to try to get that link to somebody, right? 42 42
And so they might do this by posting it on a trusted website 43 43
or embedding it into an email message 44 44
or into a forum post or something like that. 45 45
Any way they can get this crafted URL 46 46
into somebody's hands where they can click on it 47 47
when they're on a trusted website is a good deal for them. 48 48
Then they go into Step 3. 49 49
This is where the trusted site is going to return a page 50 50
containing the malicious code injected. 51 51
So the users click the link 52 52
and the trusted site is going to execute 53 53
its code inside of its site, 54 54
but we've injected this other code through this link, 55 55
so now it's going to embed that malicious code inside 56 56
and present that to the user. 57 57
Now, the user thinks it's trusted 58 58
because it's coming from a trusted site. 59 59
And so, on Number 4, 60 60
we see the malicious code is going to run 61 61
in the client's browser. 62 62
Now, when this happens, 63 63
it's going to run with the permission level of the trusted site 64 64
because it thinks this came from the trusted site. 65 65
And that's why we call this cross-site scripting 66 66
because if I'm going to Facebook 67 67
and somebody has injected code into it, 68 68
it's crossing from their site into Facebook 69 69
and then from Facebook to me, 70 70
and I'm trusting it because I trusted Facebook. 71 71
That's the idea here. 72 72
Now, the malicious code here 73 73
could be used to do lots of different things. 74 74
It might deface the trusted site 75 75
by adding some kind of extra HTML code. 76 76
It could steal data from the user by taking their cookies. 77 77
It could try to intercept communications 78 78
that are being entered into a form, 79 79
or it might try to even install malware on your system. 80 80
There is lots of things 81 81
we can use cross-site scripting for as an attacker, 82 82
and so we want to make sure we're trying to prevent it. 83 83
Now again, the reason why cross-site scripting 84 84
is so dangerous here 85 85
is because it breaks the browser's security model 86 86
because browsers assume that scripting was safe. 87 87
That's how they were designed. 88 88
They were designed to assume 89 89
that when they're talking to a trusted site 90 90
and that trusted site gives them scripts, 91 91
that was something they were supposed to run 92 92
because that is how websites are designed. 93 93
If you go to my website, 94 94
there are scripts that have to run 95 95
otherwise you can't get your quizzes. 96 96
That's the idea here. 97 97
And so this is one of the reasons 98 98
why cross-site scripting is such a dangerous thing for us. 99 99
Now, let me show you what an example 100 100
of cross-site scripting might look like. 101 101
We talked about crafting these URLs. 102 102
Well, let's say I wanted to do one 103 103
and I did it on my own site. 104 104
https://www.diontraining.com/search?q= 105 105
and then you see <script%20type=application/javascript 106 106
alert XSS script. 107 107
Now, what is this saying? 108 108
Well, we're going to MySite the trusted site 109 109
and we're going to search something. 110 110
Now, normally we would have a search query here 111 111
that's what Q equals, 112 112
and we would type in a word 113 113
like maybe you're tryna search for a CompTIA voucher 114 114
so you type in CompTIA, 115 115
and then you would search based on the keyword CompTIA 116 116
that was passed to my database. 117 117
Well, in this case, instead, 118 118
we are going to run this script. 119 119
This is a basic JavaScript. 120 120
It's going to cause an alert to pop up 121 121
and the alert that's going to pop up is just going to say XSS. 122 122
This is something we use to test 123 123
if your site is vulnerable to cross-site scripting. 124 124
But it still shows the point, 125 125
we're taking code that shouldn't be trusted 126 126
and running it through your site. 127 127
And this is how you can do this kind of thing 128 128
with cross-site scripting. 129 129
Now, this example that I just showed you is what we call 130 130
a reflected or non-persistent cross-site scripting attack. 131 131
The reason it's called that 132 132
is because it only happens once 133 133
when you click on that link 134 134
or you load it into your browser and hit Enter, 135 135
it happens one time and it stops. 136 136
It's not persistent. 137 137
This is why it's called 138 138
a non-persistent cross-site scripting attack, 139 139
also known as reflected attack. 140 140
Now, in addition to that, we have other types. 141 141
We have ones like persistent cross-site scripting. 142 142
Now, this is an attack that inserts code 143 143
into the backend database that's used by the trusted site. 144 144
Now, the benefit of doing this 145 145
is that you don't have to wait for somebody 146 146
to actually click on a link 147 147
because it's already embedded into that database. 148 148
And so, with a persistent cross-site scripting attack, 149 149
it sits there always because it's already been injected. 150 150
We don't have to get them to click my particular link. 151 151
It's already there. 152 152
Anytime they load that thing from the database, 153 153
they're going to load in that cross-site script. 154 154
Now, when we talk about these different cross-site scripting 155 155
I mentioned there was reflected 156 156
and non-persistent and persistent, 157 157
these attacks occur as what are known 158 158
as server-side scripting attacks 159 159
because I'm having the server execute this code 160 160
and present it to your browser to trust. 161 161
Now, there's another type of cross-site scripting attack 162 162
known as a DOM cross-site scripting attack 163 163
which is document object model cross-site scripting. 164 164
Now, when we talk about this, this is a client-side attack. 165 165
This is an attack that exploits the client's web browser 166 166
using client-side scripts to modify the content 167 167
and layout of the webpage. 168 168
When we talk about the document object model, 169 169
the DOM, that is how we display things in the client browser 170 170
and you can change that and modify it 171 171
if you have the right codes. 172 172
Now, let me give you an example of this. 173 173
Here's a website URL, 174 174
https://diontraining.com/index.html# 175 175
default=scriptalertdocument.cookie/script. 176 176
Now, at first glance, 177 177
this looks a lot like the other one we had. 178 178
We had some kind of a script 179 179
and some kind of an alert happening. 180 180
But the difference here is the payload itself. 181 181
What we're doing here is we are alerting 182 182
on document.cookie. 183 183
The document there is the document object model, the DOM, 184 184
and in this case, 185 185
I'm tryna access the cookies that are stored 186 186
inside of that web browser. 187 187
This is the idea of what's happening here. 188 188
This payload is going to happen on the client's side. 189 189
When the client sees this, it goes, 190 190
"Oh, document.cookie. 191 191
You want to see what my cookies are?" 192 192
And it will display those cookies. 193 193
That's the idea here with this DOM variable 194 194
of document.cookie. 195 195
Now, there's other ones out there 196 196
with document dot other things like document.write, 197 197
document.location, and other things like that. 198 198
Now again, 199 199
when you're dealing with a DOM cross-site scripting attack, 200 200
you're going to be running with the logged-in user permissions 201 201
of that local system. 202 202
When we talked about the browser models before 203 203
based on server side, 204 204
it only has the browser's permissions, 205 205
but now, we actually have even more permissions 206 206
'cause we can do whatever we want in the local system 207 207
because we are a user level on that system. 208 208
Now, for the exam, 209 209
when you see something with script in it, 210 210
it's usually going to be a cross-site scripting attack. 211 211
So if you see that bracket script bracket, 212 212
that's an idea of a cross-site scripting attack. 213 213
If you see something with JavaScript as part of the URL 214 214
that was captured within a log, 215 215
again, this is likely going to be 216 216
a cross-site scripting attack. 217 217
Usually, you're not going to be asked to be identified 218 218
between these three types of attacks, 219 219
between reflected or non-persistent, persistent or DOM 220 220
when you're talking about cross-site scripting attacks. 221 221
You're just going to be asked 222 222
"Is this a cross-site scripting attack or not?" 223 223
Now, if they want you to identify something 224 224
as a DOM cross-site scripting attack, 225 225
they won't give you the option of the other two 226 226
in that question. 227 227
Instead though, if you see something 228 228
like script alert document dot something 229 229
like in my example, document.cookie or document.write, 230 230
that would tell you this has something to do with the DOM, 231 231
and therefore, 232 232
it has something to do with that document object model 233 233
and it's a DOM cross-site scripting attack.