Scribd Logo
Upload

Welcome to Scribd!

  • 94 views

    DOM Based Cross-Site Scripting

    Uploaded by

    Aromal Raveendran
    DOM-based cross-site scripting (XSS) occurs when untrusted user input is used to dynamically generate web pages through client-side scripts. This allows attackers to inject malicious scripts that are executed by a victim's browser. To prevent DOM-based XSS, developers must sanitize all untrusted user input, validate that it contains only expected values, and avoid injecting it directly into the DOM. Input sources like document.URL and document.location must be carefully validated to block script injection.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd

    DOM Based Cross-Site Scripting

    Uploaded by

    Aromal Raveendran
    94 views3 pages
    DOM-based cross-site scripting (XSS) occurs when untrusted user input is used to dynamically generate web pages through client-side scripts. This allows attackers to inject malicious scripts that are executed by a victim's browser. To prevent DOM-based XSS, developers must sanitize all untrusted user input, validate that it contains only expected values, and avoid injecting it directly into the DOM. Input sources like document.URL and document.location must be carefully validated to block script injection.

    Original Description:

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    DOM-based cross-site scripting (XSS) occurs when untrusted user input is used to dynamically generate web pages through client-side scripts. This allows attackers to inject malicious scripts that are executed by a victim's browser. To prevent DOM-based XSS, developers must sanitize all untrusted user input, validate that it contains only expected values, and avoid injecting it directly into the DOM. Input sources like document.URL and document.location must be carefully validated to block script injection.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    94 views3 pages

    DOM Based Cross-Site Scripting

    Uploaded by

    Aromal Raveendran
    DOM-based cross-site scripting (XSS) occurs when untrusted user input is used to dynamically generate web pages through client-side scripts. This allows attackers to inject malicious scripts that are executed by a victim's browser. To prevent DOM-based XSS, developers must sanitize all untrusted user input, validate that it contains only expected values, and avoid injecting it directly into the DOM. Input sources like document.URL and document.location must be carefully validated to block script injection.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 3
    At a glance
    Powered by AI
    DOM-based XSS occurs when untrusted client-side code, like JavaScript, is used to inject malicious scripts into web pages. This can allow attackers to steal session cookies and impersonate users.

    DOM-based XSS happens when user-supplied data is used in the DOM without being sanitized, allowing attackers to inject malicious scripts. This is different from stored and reflected XSS which rely on the server to inject scripts.

    The example HTML page 'age.html' demonstrates a DOM-based XSS vulnerability by taking the 'age' parameter from the URL and displaying it without sanitization, allowing an attacker to inject arbitrary scripts.

    DOM Based Cross-Site Scripting

    Application WASC Threat Classification Cross-site Scripting http://projects.webappsec.org/Cross-Site+Scripting CVE ID(s) N/A CWE ID(s) 79 Security Risks It is possible to steal or manipulate customer session and cookies, which might be used to impersonate a legitimate user, allowing the hacker to view or alter user records, and to perform transactions as that user Possible Causes The web application uses client-side logic to create web pages Technical Description In DOM-based XSS, the client performs the injection of XSS into the page, as opposed to other XSS types (Reflected and Stored XSS) where the server performs the injection. DOM-based XSS generally involves server-controlled, trusted script (such as Javascript) that is sent to the client and performs sanity checks on a form before the user submits it. If the server-supplied script processes usersupplied data, and then injects it back into the web page (such as with dynamic HTML), then DOMbased XSS is possible. The following code snippet (age.html) demonstrates a DOM Cross-Site Scripting vulnerability: <HTML> <BODY> Hello! <BR> Your age is: <SCRIPT> var position=document.URL.indexOf("age=")+4; document.write(document.URL.substring(position,document.URL.length)); </SCRIPT> </BODY> </HTML> Normally, this HTML page would be used for presenting the user's age, e.g.: http://SERVER/age.html?age=21 However, issuing the following request will result in an XSS condition: http://SERVER/age.html?age=<script>alert(document.cookie)</script> Note there is no need for malicious code to be embedded in the server's response for the attack to succeed. General Fix Recommendations

    Analyze and harden client side (JavaScript) code. Sanitize input sources which can be influenced by an attacker. For example: - document.URL - document.URLUnencoded - document.location (and many of its properties) - document.referrer - window.location (and many of its properties) Special attention should be given to scenarios in which the DOM is modified. For example: - Write raw HTML, e.g.: * document.write(...) * document.writeln(...) * document.body.innerHtml=... - Directly modifying the DOM (including DHTML events), e.g.: * document.forms[0].action=... (and various other collections) * document.attachEvent(...) * document.create...(...) * document.execCommand(...) * document.body. ... (accessing the DOM through the body object) * window.attachEvent(...) - Replacing the document URL, e.g.: * document.location=... (and assigning to location's href, host and hostname) * document.location.hostname=... * document.location.replace(...) * document.location.assign(...) * document.URL=... * window.navigate(...) - Opening/modifying a window, e.g.: * document.open(...) * window.open(...) * window.location.href=... (and assigning to location's href, host and hostname) - Directly executing script, e.g.: * eval(...) * window.execScript(...) * window.setInterval(...) * window.setTimeout(...) Consider the following vulnerable script: <SCRIPT> var position=document.URL.indexOf("age=")+4; document.write(document.URL.substring(position,document.URL.length)); </SCRIPT> In this example the age parameter isn't sanitized, therefore the script is susceptible to DOM CrossSite Scripting attacks. A safe version of this script would be: <SCRIPT> var position=document.URL.indexOf("age=")+4; var age=document.URL.substring(position,document.URL.length); if (age.match(/^[0-9]*$/))
    6/4/2013 14:11:25 Prepared By: Aneesh & Sabin Reviewed By :Reji Nair 291/298

    { document.write(age); } else { window.alert("Illegal input.\nAge parameter should be composed from numerical characters only."); } </SCRIPT> In this version, the age parameter is validated to make sure it doesn't contain hazardous characters. Please also see the "DOM based XSS Prevention Cheat Sheet": http://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet by OWASP, for more information.

    References and Relevant Links N/A

    You might also like