1 1 00:00:00,000 --> 00:00:02,280 Cross-Site Scripting. 2 2 00:00:02,280 --> 00:00:03,240 In this lesson, 3 3 00:00:03,240 --> 00:00:05,970 we are going to talk about cross-site scripting. 4 4 00:00:05,970 --> 00:00:09,791 Now, cross-site scripting is also known as XSS. 5 5 00:00:09,791 --> 00:00:11,935 Now, cross-site scripting is a malicious script 6 6 00:00:11,935 --> 00:00:13,890 that's hosted on the attacker site 7 7 00:00:13,890 --> 00:00:17,370 or coded in a link that's injected onto a trusted site 8 8 00:00:17,370 --> 00:00:18,446 designed to compromise clients 9 9 00:00:18,446 --> 00:00:20,533 that are browsing that trusted site, 10 10 00:00:20,533 --> 00:00:23,550 thereby, circumventing the browser security model 11 11 00:00:23,550 --> 00:00:25,110 of trusted zones. 12 12 00:00:25,110 --> 00:00:27,480 Essentially, we're trying to get you to click on something 13 13 00:00:27,480 --> 00:00:28,934 or run some kind of script 14 14 00:00:28,934 --> 00:00:31,080 that your system doesn't want to do. 15 15 00:00:31,080 --> 00:00:33,390 We're tryna bypass your security. 16 16 00:00:33,390 --> 00:00:35,280 Now, when we talk about cross-site scripting, 17 17 00:00:35,280 --> 00:00:36,113 I want you to remember 18 18 00:00:36,113 --> 00:00:40,380 cross-site scripting is a powerful input validation exploit. 19 19 00:00:40,380 --> 00:00:41,610 So what does that mean? 20 20 00:00:41,610 --> 00:00:43,110 It means to protect yourself from this, 21 21 00:00:43,110 --> 00:00:44,905 you need to do input validation. 22 22 00:00:44,905 --> 00:00:47,220 If you're not doing proper input validation, 23 23 00:00:47,220 --> 00:00:50,520 you are going to fall victim to a cross-site scripting attack. 24 24 00:00:50,520 --> 00:00:52,590 Now, how does this really work in the real world? 25 25 00:00:52,590 --> 00:00:53,789 Well, there's really four steps 26 26 00:00:53,789 --> 00:00:55,950 to a cross-site scripting attack. 27 27 00:00:55,950 --> 00:00:57,125 Now, in its most basic form, 28 28 00:00:57,125 --> 00:00:59,200 the first step of a cross-site scripting attack 29 29 00:00:59,200 --> 00:01:00,810 is for the attacker to identify 30 30 00:01:00,810 --> 00:01:04,800 input validation vulnerabilities within a trusted website. 31 31 00:01:04,800 --> 00:01:06,058 So, let's say they find my website 32 32 00:01:06,058 --> 00:01:08,010 and they find out that when I'm taking input 33 33 00:01:08,010 --> 00:01:10,411 into my username and password for you to log in, 34 34 00:01:10,411 --> 00:01:12,480 I'm not validating that data. 35 35 00:01:12,480 --> 00:01:14,070 That would make it a good candidate 36 36 00:01:14,070 --> 00:01:15,720 for cross-site scripting. 37 37 00:01:15,720 --> 00:01:17,087 Then, they go into Step 2 38 38 00:01:17,087 --> 00:01:19,620 which is where the attacker's going to craft a URL 39 39 00:01:19,620 --> 00:01:23,070 to perform code injection against that trusted website. 40 40 00:01:23,070 --> 00:01:24,870 Now, while they're in this Step Number 2, 41 41 00:01:24,870 --> 00:01:27,870 they're also going to try to get that link to somebody, right? 42 42 00:01:27,870 --> 00:01:30,600 And so they might do this by posting it on a trusted website 43 43 00:01:30,600 --> 00:01:32,340 or embedding it into an email message 44 44 00:01:32,340 --> 00:01:34,890 or into a forum post or something like that. 45 45 00:01:34,890 --> 00:01:37,260 Any way they can get this crafted URL 46 46 00:01:37,260 --> 00:01:39,270 into somebody's hands where they can click on it 47 47 00:01:39,270 --> 00:01:42,240 when they're on a trusted website is a good deal for them. 48 48 00:01:42,240 --> 00:01:43,524 Then they go into Step 3. 49 49 00:01:43,524 --> 00:01:45,723 This is where the trusted site is going to return a page 50 50 00:01:45,723 --> 00:01:48,120 containing the malicious code injected. 51 51 00:01:48,120 --> 00:01:49,051 So the users click the link 52 52 00:01:49,051 --> 00:01:51,545 and the trusted site is going to execute 53 53 00:01:51,545 --> 00:01:53,340 its code inside of its site, 54 54 00:01:53,340 --> 00:01:55,830 but we've injected this other code through this link, 55 55 00:01:55,830 --> 00:01:57,994 so now it's going to embed that malicious code inside 56 56 00:01:57,994 --> 00:02:00,060 and present that to the user. 57 57 00:02:00,060 --> 00:02:01,500 Now, the user thinks it's trusted 58 58 00:02:01,500 --> 00:02:03,270 because it's coming from a trusted site. 59 59 00:02:03,270 --> 00:02:04,560 And so, on Number 4, 60 60 00:02:04,560 --> 00:02:06,330 we see the malicious code is going to run 61 61 00:02:06,330 --> 00:02:07,800 in the client's browser. 62 62 00:02:07,800 --> 00:02:09,120 Now, when this happens, 63 63 00:02:09,120 --> 00:02:11,790 it's going to run with the permission level of the trusted site 64 64 00:02:11,790 --> 00:02:14,245 because it thinks this came from the trusted site. 65 65 00:02:14,245 --> 00:02:16,770 And that's why we call this cross-site scripting 66 66 00:02:16,770 --> 00:02:18,097 because if I'm going to Facebook 67 67 00:02:18,097 --> 00:02:20,192 and somebody has injected code into it, 68 68 00:02:20,192 --> 00:02:23,034 it's crossing from their site into Facebook 69 69 00:02:23,034 --> 00:02:24,780 and then from Facebook to me, 70 70 00:02:24,780 --> 00:02:27,240 and I'm trusting it because I trusted Facebook. 71 71 00:02:27,240 --> 00:02:28,759 That's the idea here. 72 72 00:02:28,759 --> 00:02:30,330 Now, the malicious code here 73 73 00:02:30,330 --> 00:02:32,730 could be used to do lots of different things. 74 74 00:02:32,730 --> 00:02:34,260 It might deface the trusted site 75 75 00:02:34,260 --> 00:02:36,480 by adding some kind of extra HTML code. 76 76 00:02:36,480 --> 00:02:38,823 It could steal data from the user by taking their cookies. 77 77 00:02:38,823 --> 00:02:40,558 It could try to intercept communications 78 78 00:02:40,558 --> 00:02:42,360 that are being entered into a form, 79 79 00:02:42,360 --> 00:02:45,150 or it might try to even install malware on your system. 80 80 00:02:45,150 --> 00:02:46,050 There is lots of things 81 81 00:02:46,050 --> 00:02:48,437 we can use cross-site scripting for as an attacker, 82 82 00:02:48,437 --> 00:02:51,150 and so we want to make sure we're trying to prevent it. 83 83 00:02:51,150 --> 00:02:52,991 Now again, the reason why cross-site scripting 84 84 00:02:52,991 --> 00:02:54,361 is so dangerous here 85 85 00:02:54,361 --> 00:02:56,880 is because it breaks the browser's security model 86 86 00:02:56,880 --> 00:02:58,993 because browsers assume that scripting was safe. 87 87 00:02:58,993 --> 00:03:00,570 That's how they were designed. 88 88 00:03:00,570 --> 00:03:01,429 They were designed to assume 89 89 00:03:01,429 --> 00:03:02,913 that when they're talking to a trusted site 90 90 00:03:02,913 --> 00:03:05,130 and that trusted site gives them scripts, 91 91 00:03:05,130 --> 00:03:06,540 that was something they were supposed to run 92 92 00:03:06,540 --> 00:03:08,850 because that is how websites are designed. 93 93 00:03:08,850 --> 00:03:09,990 If you go to my website, 94 94 00:03:09,990 --> 00:03:11,027 there are scripts that have to run 95 95 00:03:11,027 --> 00:03:12,602 otherwise you can't get your quizzes. 96 96 00:03:12,602 --> 00:03:14,070 That's the idea here. 97 97 00:03:14,070 --> 00:03:14,903 And so this is one of the reasons 98 98 00:03:14,903 --> 00:03:18,210 why cross-site scripting is such a dangerous thing for us. 99 99 00:03:18,210 --> 00:03:19,410 Now, let me show you what an example 100 100 00:03:19,410 --> 00:03:20,850 of cross-site scripting might look like. 101 101 00:03:20,850 --> 00:03:22,983 We talked about crafting these URLs. 102 102 00:03:22,983 --> 00:03:24,372 Well, let's say I wanted to do one 103 103 00:03:24,372 --> 00:03:26,092 and I did it on my own site. 104 104 00:03:26,092 --> 00:03:31,092 https://www.diontraining.com/search?q= 105 105 00:03:34,320 --> 00:03:39,320 and then you see <script%20type=application/javascript 106 106 00:03:39,986 --> 00:03:43,350 alert XSS script. 107 107 00:03:43,350 --> 00:03:44,730 Now, what is this saying? 108 108 00:03:44,730 --> 00:03:47,460 Well, we're going to MySite the trusted site 109 109 00:03:47,460 --> 00:03:49,170 and we're going to search something. 110 110 00:03:49,170 --> 00:03:51,030 Now, normally we would have a search query here 111 111 00:03:51,030 --> 00:03:52,230 that's what Q equals, 112 112 00:03:52,230 --> 00:03:53,280 and we would type in a word 113 113 00:03:53,280 --> 00:03:55,260 like maybe you're tryna search for a CompTIA voucher 114 114 00:03:55,260 --> 00:03:56,700 so you type in CompTIA, 115 115 00:03:56,700 --> 00:03:58,741 and then you would search based on the keyword CompTIA 116 116 00:03:58,741 --> 00:04:00,720 that was passed to my database. 117 117 00:04:00,720 --> 00:04:01,950 Well, in this case, instead, 118 118 00:04:01,950 --> 00:04:04,110 we are going to run this script. 119 119 00:04:04,110 --> 00:04:05,790 This is a basic JavaScript. 120 120 00:04:05,790 --> 00:04:07,380 It's going to cause an alert to pop up 121 121 00:04:07,380 --> 00:04:10,140 and the alert that's going to pop up is just going to say XSS. 122 122 00:04:10,140 --> 00:04:11,022 This is something we use to test 123 123 00:04:11,022 --> 00:04:13,800 if your site is vulnerable to cross-site scripting. 124 124 00:04:13,800 --> 00:04:15,000 But it still shows the point, 125 125 00:04:15,000 --> 00:04:16,830 we're taking code that shouldn't be trusted 126 126 00:04:16,830 --> 00:04:19,110 and running it through your site. 127 127 00:04:19,110 --> 00:04:20,820 And this is how you can do this kind of thing 128 128 00:04:20,820 --> 00:04:22,470 with cross-site scripting. 129 129 00:04:22,470 --> 00:04:24,596 Now, this example that I just showed you is what we call 130 130 00:04:24,596 --> 00:04:27,989 a reflected or non-persistent cross-site scripting attack. 131 131 00:04:27,989 --> 00:04:29,160 The reason it's called that 132 132 00:04:29,160 --> 00:04:30,492 is because it only happens once 133 133 00:04:30,492 --> 00:04:31,910 when you click on that link 134 134 00:04:31,910 --> 00:04:33,944 or you load it into your browser and hit Enter, 135 135 00:04:33,944 --> 00:04:35,699 it happens one time and it stops. 136 136 00:04:35,699 --> 00:04:37,018 It's not persistent. 137 137 00:04:37,018 --> 00:04:38,250 This is why it's called 138 138 00:04:38,250 --> 00:04:39,930 a non-persistent cross-site scripting attack, 139 139 00:04:39,930 --> 00:04:41,908 also known as reflected attack. 140 140 00:04:41,908 --> 00:04:44,130 Now, in addition to that, we have other types. 141 141 00:04:44,130 --> 00:04:46,253 We have ones like persistent cross-site scripting. 142 142 00:04:46,253 --> 00:04:48,049 Now, this is an attack that inserts code 143 143 00:04:48,049 --> 00:04:51,179 into the backend database that's used by the trusted site. 144 144 00:04:51,179 --> 00:04:52,364 Now, the benefit of doing this 145 145 00:04:52,364 --> 00:04:53,758 is that you don't have to wait for somebody 146 146 00:04:53,758 --> 00:04:55,013 to actually click on a link 147 147 00:04:55,013 --> 00:04:57,930 because it's already embedded into that database. 148 148 00:04:57,930 --> 00:05:00,060 And so, with a persistent cross-site scripting attack, 149 149 00:05:00,060 --> 00:05:02,910 it sits there always because it's already been injected. 150 150 00:05:02,910 --> 00:05:04,568 We don't have to get them to click my particular link. 151 151 00:05:04,568 --> 00:05:05,460 It's already there. 152 152 00:05:05,460 --> 00:05:07,470 Anytime they load that thing from the database, 153 153 00:05:07,470 --> 00:05:09,736 they're going to load in that cross-site script. 154 154 00:05:09,736 --> 00:05:11,872 Now, when we talk about these different cross-site scripting 155 155 00:05:11,872 --> 00:05:13,095 I mentioned there was reflected 156 156 00:05:13,095 --> 00:05:15,690 and non-persistent and persistent, 157 157 00:05:15,690 --> 00:05:17,280 these attacks occur as what are known 158 158 00:05:17,280 --> 00:05:18,773 as server-side scripting attacks 159 159 00:05:18,773 --> 00:05:21,750 because I'm having the server execute this code 160 160 00:05:21,750 --> 00:05:23,917 and present it to your browser to trust. 161 161 00:05:23,917 --> 00:05:26,299 Now, there's another type of cross-site scripting attack 162 162 00:05:26,299 --> 00:05:28,710 known as a DOM cross-site scripting attack 163 163 00:05:28,710 --> 00:05:31,490 which is document object model cross-site scripting. 164 164 00:05:31,490 --> 00:05:34,770 Now, when we talk about this, this is a client-side attack. 165 165 00:05:34,770 --> 00:05:36,950 This is an attack that exploits the client's web browser 166 166 00:05:36,950 --> 00:05:39,763 using client-side scripts to modify the content 167 167 00:05:39,763 --> 00:05:41,463 and layout of the webpage. 168 168 00:05:41,463 --> 00:05:43,770 When we talk about the document object model, 169 169 00:05:43,770 --> 00:05:47,220 the DOM, that is how we display things in the client browser 170 170 00:05:47,220 --> 00:05:49,260 and you can change that and modify it 171 171 00:05:49,260 --> 00:05:50,910 if you have the right codes. 172 172 00:05:50,910 --> 00:05:52,571 Now, let me give you an example of this. 173 173 00:05:52,571 --> 00:05:54,720 Here's a website URL, 174 174 00:05:54,720 --> 00:05:59,720 https://diontraining.com/index.html# 175 175 00:06:01,200 --> 00:06:06,090 default=scriptalertdocument.cookie/script. 176 176 00:06:06,090 --> 00:06:06,960 Now, at first glance, 177 177 00:06:06,960 --> 00:06:08,640 this looks a lot like the other one we had. 178 178 00:06:08,640 --> 00:06:09,560 We had some kind of a script 179 179 00:06:09,560 --> 00:06:11,550 and some kind of an alert happening. 180 180 00:06:11,550 --> 00:06:14,040 But the difference here is the payload itself. 181 181 00:06:14,040 --> 00:06:15,960 What we're doing here is we are alerting 182 182 00:06:15,960 --> 00:06:17,310 on document.cookie. 183 183 00:06:17,310 --> 00:06:20,821 The document there is the document object model, the DOM, 184 184 00:06:20,821 --> 00:06:21,780 and in this case, 185 185 00:06:21,780 --> 00:06:23,610 I'm tryna access the cookies that are stored 186 186 00:06:23,610 --> 00:06:25,890 inside of that web browser. 187 187 00:06:25,890 --> 00:06:27,600 This is the idea of what's happening here. 188 188 00:06:27,600 --> 00:06:29,768 This payload is going to happen on the client's side. 189 189 00:06:29,768 --> 00:06:31,537 When the client sees this, it goes, 190 190 00:06:31,537 --> 00:06:32,988 "Oh, document.cookie. 191 191 00:06:32,988 --> 00:06:34,620 You want to see what my cookies are?" 192 192 00:06:34,620 --> 00:06:35,942 And it will display those cookies. 193 193 00:06:35,942 --> 00:06:38,460 That's the idea here with this DOM variable 194 194 00:06:38,460 --> 00:06:39,870 of document.cookie. 195 195 00:06:39,870 --> 00:06:41,400 Now, there's other ones out there 196 196 00:06:41,400 --> 00:06:44,340 with document dot other things like document.write, 197 197 00:06:44,340 --> 00:06:46,860 document.location, and other things like that. 198 198 00:06:46,860 --> 00:06:47,693 Now again, 199 199 00:06:47,693 --> 00:06:49,883 when you're dealing with a DOM cross-site scripting attack, 200 200 00:06:49,883 --> 00:06:52,740 you're going to be running with the logged-in user permissions 201 201 00:06:52,740 --> 00:06:54,180 of that local system. 202 202 00:06:54,180 --> 00:06:55,645 When we talked about the browser models before 203 203 00:06:55,645 --> 00:06:57,330 based on server side, 204 204 00:06:57,330 --> 00:06:59,010 it only has the browser's permissions, 205 205 00:06:59,010 --> 00:07:01,106 but now, we actually have even more permissions 206 206 00:07:01,106 --> 00:07:03,265 'cause we can do whatever we want in the local system 207 207 00:07:03,265 --> 00:07:06,480 because we are a user level on that system. 208 208 00:07:06,480 --> 00:07:07,800 Now, for the exam, 209 209 00:07:07,800 --> 00:07:09,840 when you see something with script in it, 210 210 00:07:09,840 --> 00:07:12,510 it's usually going to be a cross-site scripting attack. 211 211 00:07:12,510 --> 00:07:14,434 So if you see that bracket script bracket, 212 212 00:07:14,434 --> 00:07:16,706 that's an idea of a cross-site scripting attack. 213 213 00:07:16,706 --> 00:07:19,351 If you see something with JavaScript as part of the URL 214 214 00:07:19,351 --> 00:07:20,984 that was captured within a log, 215 215 00:07:20,984 --> 00:07:22,413 again, this is likely going to be 216 216 00:07:22,413 --> 00:07:24,840 a cross-site scripting attack. 217 217 00:07:24,840 --> 00:07:26,575 Usually, you're not going to be asked to be identified 218 218 00:07:26,575 --> 00:07:28,680 between these three types of attacks, 219 219 00:07:28,680 --> 00:07:31,907 between reflected or non-persistent, persistent or DOM 220 220 00:07:31,907 --> 00:07:34,200 when you're talking about cross-site scripting attacks. 221 221 00:07:34,200 --> 00:07:35,033 You're just going to be asked 222 222 00:07:35,033 --> 00:07:36,990 "Is this a cross-site scripting attack or not?" 223 223 00:07:36,990 --> 00:07:38,440 Now, if they want you to identify something 224 224 00:07:38,440 --> 00:07:40,657 as a DOM cross-site scripting attack, 225 225 00:07:40,657 --> 00:07:42,990 they won't give you the option of the other two 226 226 00:07:42,990 --> 00:07:44,220 in that question. 227 227 00:07:44,220 --> 00:07:45,303 Instead though, if you see something 228 228 00:07:45,303 --> 00:07:48,967 like script alert document dot something 229 229 00:07:48,967 --> 00:07:52,768 like in my example, document.cookie or document.write, 230 230 00:07:52,768 --> 00:07:55,470 that would tell you this has something to do with the DOM, 231 231 00:07:55,470 --> 00:07:56,400 and therefore, 232 232 00:07:56,400 --> 00:07:58,560 it has something to do with that document object model 233 233 00:07:58,560 --> 00:08:00,710 and it's a DOM cross-site scripting attack.