___________ ____________ ____ __ ___ ______________ |\ ____ \ |\ ____ \ |\ \|\ \|\ \ |\_____ ____\ | \ \__|\ \ | \ \__|\ \ | \ \ \ \ \ \ | | |\ \ | \ \ ___ | \ \ ____ \ \ \ \_| \_| \ \|___| \ \__| \ \ \_|\ \_ \ \ \__|\ \ \ \ _ \ \ \ \ \ \ \\ \ \ \ \ \ \ \ \ \ \ |\ http://www.haxworx.com \ \___\\ \___\ \ \___\ \ \___\ \ \____| \_____\ \ \___\ \ | | \ | | \ | | \ | | \ | |\ | | \ | | \|___| \|___| \|___| \|___| \|___| \|____| \|___| /*************************************************************** Cross-Site Scripting (SORT OF) Explained!!!! Author: BrainRawt | Email: brainrawt@hotmail.com Greetz to b0iler. ***************************************************************/ Updated on: 9-6-02 What is Cross-Site Scripting (CSS/XSS)? -------------------------------------------- Cross-Site Scripting is what we call, the injection of malicious input to the html of a remote wepage, executable by clients with the thought that it is coming from the trustworthy webpage itself. Cross-Site scripting is sometimes refered to as "XSS", because "CSS" is often confused with Cascading Style Sheets. If you hear someone refering to a vulnerability that involves CSS or XSS, then they are probably refering to Cross-Site scripting. Difference between XSS and Script-Injection!! Remember This!! ---------------------------------------------------------------- After having a discussion with my good friend b0iler, I have learned to understand that not every script execution vulnerability is refered to as XSS. There is another form known as "Script Injection". The difference between the two are: 1. Script-Injection is when the remotely injected script perminately modifies the webpage. 2: Cross-Site Scripting is not perminent, but is only temporary. What types of scripting can be injected into the remote webpage? ---------------------------------------------------------------- The most polular types of injection are those found below. HTML JavaScript (discussed in this paper) VBScript ActiveX Flash What Causes A Site To Be Vulnerable To XSS? ------------------------------------------- In alot of cgi/php scripts and I believe in some webservers, when something is not found or there is an error of some type, that something is printed to an html and shown to the visitor of that website. EX: 404 - yourfile.html Not Found! We dont normally pay any attention to something like this do we? We move on and forget about it. Now when we find something like this, we check to see if it is vulnerable to CSS or not. :) EXAMPLE: www.somesite.tld/cgi-bin/program.cgi?page=downloads.html is a valid url. Change downloads.html to brainrawt_owns_me.html and see what you get. www.somesite.tld/cgi-bin/program.cgi?page=brainrawt_owns_me.html 404 - brainrawt_owns_me.html Not Found! See how it wrote our input to the html? Sure you do.... Now its time we check for XSS vuln. NOTE: Below is just ONE example of how we can inject java-script to the vulnerable webpage. There are many different ways to get this done. EXAMPLE: www.somesite.tld/cgi-bin/program.cgi?page= Now what do we see when we submit this URL? A box pop up on our screen that says "XSS_Vuln_Testing"? If so then this site is vulnerable to Cross-Site Scripting. If we modified the javascript in the URL above, we could make it do evil things. The reason this worked is because, the program.cgi wrote our input to the 404 error page without filtering. This created a page that looked like what is below. 404 - Not Found! Instead of printing the input to the screen, the Invalid Input! [article=] and the java-script is executed by the visiting browser, causing a "test" box to appear on your screen. Why is the article field empty you ask? Its because the was not filtered out and was in return executed by your browser. ALL java-script is executed by the browser/client connecting to the webpage. You know that your evil enemy (b00b) has an email address there and you know that cookies are used for authentication purposes. You tell b00b to check out this article that myemailserver.tld has posted. Dear b00b, Check out the Article at the address below. www.myemailserver.tld/cgi-bin/news.cgi?article= The evil code entered between the &{[code]}; [N4]

[N4]