Testing for Reflected XSS

Commonly the attacker's code is written in the Javascript language, but other scripting languages are also used, e.g., VBScript. Attackers typically leverage these vulnerabilities to install key loggers, steal victim cookies, perform clipboard theft, and change the content of the page (e.g., download links).

One of the primary difficulties in preventing XSS vulnerabilities is proper character encoding. In some cases, the web server or the web application could not be filtering some encodings of characters, so, for example, the web application might filter out "<script>", but might not filter %3cscript%3e which simply includes another encoding of tags. 

How to Test?

Black Box Testing :This includes three phrases:

1. Detect Input Vectors. For each page tester must determine all the web-application's user based variables and ways to input them - including HTTP parameters, POST data ,hidden form field value and predefined radio or selection values

2.Analyze each input vector to detect vulnerabilities: To detect an XSS Vulnerability tester should use input Data from phrase 1 to make the browser trigger response that manifests vulnerability.Testing data can also be generated by fuzzer.

3.From the result in previous phase analyze if the web-browser response has a realistic impact on web application's security . This involves examining the web page HTML and searching for test input. The tester identifies any special characters that were not properly encoded, replaced or filtered out.

As demonstrated in previous blog , i was able to get session id and user id as proper data sanitization was not done.

This indicates a XSS vulnerability and an attacker can execute any malicious code of his choice.


Gray Box Testing
In gray box testing, the pen-tester has partial knowledge of the application. In this case, information regarding user input, input validation controls, and how the user input is rendered back to the user might be known by the pen-tester. 

Few Tools that can be used for the purpose :-

XSS Proxy , Rat Proxy

Reflected XSS Example

Lab : - Google gruyere

In Reflected XSS Attack , an attacker forces the web-application to return an errorsearch result, or any other response that includes some or all of the input provided by the user as part of the request, without that data being made safe to render in the browser, and without permanently storing the user provided data.

So here lets try to force the webapplication here to through an error , which can be easily done by giving some invalid URL

URL:-http://google-gruyere.appspot.com/421953921451/invalid

This will return an error as the term invalid in the URL is not part of URL

So what an attacker does here is he adds script in the same URL.

Sample URL :-
http://google-gruyere.appspot.com/

421953921451/invalid/<script>alert("TEST");</script>

This gives the following output:-

What's the "KICK" here ???We can use this
vulnerability to  find a user's session id
like below

URL: http://google-gruyere.appspot.com/421953921451/invalid/<script>alert(document.cookie);</script>

In the second image we can see that user's cookie which is stored in system is displayed here.

Now may be not all of us must be aware of what exactly a cookie is ?? and how can it be exploited.

Cookie:-

Cookie is small information stored in text file on user’s hard drive by web server. This information is later used by web browser to retrieve information from that machine. Generally cookie contains personalized user data or information that is used to communicate between different web pages.

How stored cookie can be security threat?

Some times personal information is stored in cookie , so if a user can have access to stored cookies then he use it for his personal benefit .

Lab Enviornment setup for performing various Techniques

Hello Guys!!!

Hope you all enjoyed going through the Articles posted  before and hope it was quite interesting and easy to understand.

Now the most important part of security testing learning is performing various techniques that we have learned on an environment.Well  there are few available Open Source labs which we can use for the purpose -  OWASP WEBGOAT , Google gruyere and many more.

I'll be using Google gruyere for the purpose.

Setup:

The setup of Google gruyere is quiet simple . All one has to do is to simply navigate to http://google-gruyere.appspot.com/start and the appEngine starts a new instance for the user
assign him a new unique id. Each instance of the app is 'sandboxed' from the other instances so your instance won't be affected by anyone else using Gruyere.

Further more Setup steps can be found here

Now we will be implementing various techniques in this lab

Types of XSS

Before with go ahead about types of XSS lets have a quick look at following attacks ,which based on how they are affecting the client or server can be categorised :-

Stored XSS

Stored XSS generally occurs when user input can be stored on the target server, in database, in the form of message in comment filed, visitor log etc. And then victim retrieves the stored data from the web application without that data being made safe to render in the browser. With the advent of HTML5, and other browser technologies, we can avoid the attack payload being permanently stored in the victim’s browser, such as an HTML5 database, and hence stopping it from reaching the server at all.

Reflected XSS

Reflected XSS occurs when user input is immediately returned by a web application in the form of a error message, search result, or any other response that includes some or all of the input provided by the user as part of the request, without that data being made safe to render in the browser, and without permanently storing the user provided data.

DOM Based XSS

Before starting what DOM Based XSS is lets know actually what DOM is ?

DOM stands for Document Object Model and is used for representing and working with objects in an HTML document. DOM consists of objects representing the document properties from the point of view of the browser. Whenever a script is executed client-side, the browser provides the code with the DOM of the HTML page where the script runs, thus, offering access to various properties of the page and their values, populated by the browser from its perspective.

DOM XSS is a type of XSS which relies on inappropriate handling, in the HTML page, of the data from its associated DOM. Among the objects in the DOM, there are several entities which the attacker can manipulate in order to generate the XSS condition, and the most exploited , from this perspective, are the document.url, document.location and document.referrer objects.

In the next Blog post we will see an example of the above .till then 

Happy Learning :)