What is Cross Site Scripting?| Cross Site Scripting Attack | Cross Site Scripting Tutorial | Edureka

[Music] hi everyone this is own car from edu Rica and today I will be speaking about cross-site scripting attacks so first let's look at the agenda for today's session firstly I'll be explaining you what cross-site scripting is the definition and a brief about what cross-site scripting attack is then I'll be explaining how cross-site scripting attack works I'll be explaining the logic behind this attack then I'll be explaining the different types of cross-site scripting attack and I'll be showing you a demo on how to use cross-site scripting attack to hack a web application and finally I'll be telling you how to prevent cross-site scripting attacks so let's move on to the first topic that is what does cross-site scripting attack cross-site scripting attack is basically a code injection attack executed on the client side of the web application the client side of a web application is usually the software that is used to interact with the web application and in most cases it is a browser that is used to interact with the web application so in cross-site scripting attack we inject a malicious code on to the web browser to make the web application do something that is ideally not supposed to do so in this case in this attack the attacker injects the malicious script through the web browser and what happens is this malicious script executes on the web application after it's injected on the web browser the malicious script is executed either when the victim visits the web page or the web server now like I told you there are different types of cross-site scripting depending on what kind of cross-site scripting is being used the malicious script executes when the victim visits the web page a single web page or maybe the web browser this attack is mainly used to steal sensitive information like cookies session tokens and maybe other sensitive information maybe if I were passing your username or password and using this malicious script using cross-site scripting those information can be stolen from the web browser or the web server cross-site scripting can also be used to modify the contents of the website because cross-site scripting attack is a code injection you can modify the contents of the website by injecting malicious code onto the web server or the web browser now this is a brief about cross-site scripting now let's see how cross-site scripting actually works let's see what's the logic behind this attack cross-site scripting is basically a web application hacking technique so you need a website you need a web server and a victim so what happens when you ideally access a website so you have your laptop and then you use the internet connection to access a webpage and maybe you interacted maybe you send data to the web application maybe you enter your data in the text box or even if you don't there is some transaction of data that's happening between you and the web server through the website so what happens is you send a request to the web server through the website and then the response from the web server is sent back to you through the web page or the web site now what happens in cross-site scripting attackers a hacker can inject a malicious code on the website which is then sent either to the victim or to the web server depending on what kind of cross-site scripting you're using and when this happens the malicious script is executed either when the victim visits our web page or when the victim tries to access a piece or access some data from the web server and when all this is happening a hacker can inject a code which can be used to steal the credentials or any sensitive information and by this logic a hacker can inject a malicious script that can be used to steal the credentials or any other sensitive information of the victim either from the web browser or the web server so this is the logic behind cross-site scripting attack now let's look at the different types of cross-site scripting attacks there are mainly three types of cross-site scripting attack one is the reflected cross-site scripting and also cross-site scripting is also known as XSS that's the application for it so the first type is reflected in this case the data is not stored on the web server the next type is a Dom which makes use of the document object model to inject the malicious script and the third type is the stored cross-site scripting in this case the malicious script is stored on the web server so I'll be explaining these types in detail in the next slides when I'm telling you how to hack each of these kind so let's move on and see how you can use cross-site scripting attack to hack above application now like I told you earlier there are three types of cross-site scripting attacks and I'll be showing you how to hack each of them so the first type would be reflected cross-site scripting so in this type of attack the script is executed on the victim side and it is mainly executed on the browser so the script is not sent to the server or even if it sent depending on the API calls or the requests the script is not stored on the browser side and that's why it's called a reflected cross-site scripting because the malicious script is reflected on the victim side and it's not really stored on the server let's see how to hack of application using reflected cross-site scripting I'm using damn vulnerable web application to show you these demos so if you don't know what this is or how to install and configure it I have a video on how to install damn vulnerable web application go through it install it on your system and then you can practice different hacking techniques on this so here I've chosen a reflected cross-site scripting attack now let's see how this works here's a text box where I have to enter my name and then hit the submit button so let me just enter some value and see how this web application is designed to work I'll be entering my name and I'll hit the submit button so I can see that this web application on this website is designed to echo my name on the web site so what happens is when I enter a name and the webpage takes the input and prints hello and the input that was given by me now as you can see I cannot really modify a lot but I have total control over what input I can give in the textbox so this is the place where I'll be injecting my code so what I'm gonna do is I'm gonna type a HTML code I'll use an h1 tag first which is used to mention the headers and I'll type something and it close attack so this is the code used to display something in h1 tag so let me just submit and if this web application is vulnerable to reflected cross-site scripting you should see a different output so let me just hit the submit button so here you can see that the output is modified because I've used the h1 tag the way that my input is displayed on the web application is different and this clearly indicates that this web application is vulnerable to cross-site scripting attacks now let me give some malicious script here so I'll be typing script this is the tag to execute any script and I'll be creating a pop-up to display something and let me just hit the submit button and if this works you should see a pop-up that says hello and yeah you did see a pop-up that says hello so this clearly means that this web application is vulnerable to reflected cross-site scripting now you might be thinking how is this hacking of web application just because I inject the code that displays the content in a different way it's not really hacking right so let me tell you how this can be dangerous so instead of displaying something in a different way I'll try to get some sensitive information from this web application and what I'm gonna do is use the script tag and create a pop-up but instead of printing a string I'll try to access the cookies for this web application or for this user basically so let me just hit the submit button and here you can see that the session ID is displayed and using this session ID I can login to a different account even if I don't know the username and password for that account now what is a session ID basically a session ID is a unique string assigned to a particular user when the session is going on by the web server to identify that particular user so suppose you login to your account your gmail account your Facebook account or your banking account and I can get hold of your session ID I can use this session ID and using a tool like burp suit again log in to your account without even knowing the password so this is how dangerous a cross-site scripting attack can be now I was just using the low security level let me just increase the security level and see what changes has to be done in this attack so I'll just increase the level to medium I'll click the reflected cross-site scripting attack again now let me give the same input let me give script alert and some string and I'll just close the script tag and hit the submit button now we can see that previously when the security was low you saw a pop-up that said hello but in this case I don't see a pop-up that means that this web application under medium security is doing something to avoid cross-site scripting now how would you know what it's actually doing now look at the output the input I gave was script alert hello and I close the script tag so this was the input that I gave to the web application and the output was only this so this means that the web application is doing something to eliminate this script tag and the end script tag so I'll just change my input to something like this so I'll be using the same input but I'll modify it a little because the web application is designed to remove the script tag I just modify it a little I just modified this code to look something like this I'll add a nested script tag first let me give this as an input let's see if it works and if it works I'll tell you how this actually works and what's the logic behind this so let's copy paste this and let me hit the submit button now like you can see this actually worked so when I use the nested script tag it actually worked now let me explain how this actually worked so like I told you this web application is designed to eliminate the script tag and when I give this as the input what the web application did is it looked at the input it found the script tag here and it eliminated the script tag and because I had nested a script tag even when it eliminated the main script tag there was another script tag that was formed and this is how you could see the pop-up so basically when you necess tag the script tag is eliminated and when the script tag is eliminated the divided part of the script tag is concatenated as a string like you can see here and then this code is executed so this is how we can use cross-site scripting if the web application is designed to eliminate the script tag now let me just increase the security I'll just increase it to high and hit the submit button then let me go to cross-site scripting reflected let me give the first input the does the direct approach and you don't see a pop up so it means that the web application is handling the cross-site scripting attack let me try the previous input and even now you see the same output now let me just show you the code that is used to sanitizer input on this web application so this is the code that is used to sanitize the input so what's happening here is this code is making use of regular expression and wherever there's a script tag found or wherever there's a script tag formed it is replacing that with a blank space or with a empty character so basically this means that we cannot use the script tag in any way now what other options do we have so what you can do is give a malicious script or give a malicious input without using a script tag now what you can do is you can use other tags of HTML or PHP are using the image tag I'll be mentioning the source to some random thing and I'll be using this function called on mouse-over and what the webpage should do when the mouse is over that particular image so this line basically tells there's a image and the source to that image is this file which is a dummy value in this case and if the mouse is over that image then create a pop-up that displays the string hello let me just give this as the input and see if it works I just hit the submit button okay so now we can see that it says hello but you didn't see a pop-up and because if you've given a function on mouse-over for the alert or for the pop-up to appear you have to move your cursor on the image so when I move the cursor on the image you see that the pop-up appears now what you can do is in this case I have not given any image as a source but what you can do is you can download a image that says click here and instead of giving a dummy value you can give the source to that image so when you use that malicious code what will be this did as hello and the image that says click here so when the user will go to that image to click on that image basically because the mouse is over that image you see a pop-up so that's when your malicious code will be executed so this is all about a reflected cross-site scripting let's move on to the next type that is stored cross-site scripting so like you saw in reflected cross-site scripting the data is not being stored on the web server it is executed on the web browser now in store cross-site scripting what happens is the script is stored and executed on the server so there are a lot of web applications like Facebook where you comment on a picture of a someone uploads a picture you comment on a picture or you post a status on your wall or on your timeline so this data is stored in the database of the server and every time somebody clicks on that page or tries to access that data the web server fetches that data from the database and then displays it on the web browser so when you're using stored cross-site scripting attack you are basically storing this malicious script on the web server or the database that is being used by the web server the advantage of stored cross-site scripting is because it is stored on the web server every time any user that is accessing that data will be executing the malicious code now let's see how you can use store cross-site scripting to hack a web application so this is a web page first hole cross-site scripting attack there's a name and there's a message so let me just give some input I'll type test1 and the message will be message 1 and I'll just hit the sign guestbook button so be this takes a name and it takes a message and then it stores that so even if i refresh this you can see that the data is still present because this is stored in a database and it is being fest every time I access this web page now what I'm gonna do is try to inject some malicious code here so I'll give the name as test2 and then I'll try the first input the direct approach and I'll hit the sign the guestbook button so you can see that there's a pop of that appear so this means that this above application is vulnerable to cross-site scripting attack so even if i refresh this you can see that it executes the malicious script execute so every time I user visits this web page the malicious script executes so it's the same in the case of applications that store data from the user for example like I told you about Facebook when you post something there's a comment or when you post something on your timeline you post the status on a timeline and any other user or any other profile accesses that piece to view your photos or to look at your status or the comments on any of the posts they basically as a web server to fetch that data and that data is basically stored in a database so in that case any user who accesses that data executes that malicious script now let me just increase the security and see what changes we have to make or what security features have been implemented and before tying the next injection I just clear this guestbook or elles every time i refresh the malicious code will be executed and I'll see the outputs I'll see the pocket so let me just clear the guestbook all right so what I'm gonna do is gonna type the same input that I gave earlier so that'll be test one and the malicious script hit the guestbook button and see that it's not working I don't see a pop-up here so there's some way that this web application on a medium level is handling the malicious input now I'm gonna try to give the malicious input in the name field but I'm not able to type a lot of characters let me see the message field I just type message 1 and I'm not able to type more characters so this is because the textbox is limited to take a limited number of characters I'm gonna manipulate this by changing that restriction so what I'm gonna do I'm gonna inspect the webpage and here I can see that there's a line that says max length equal to 10 which means that this text box is designed to take only 10 characters as input so what I'm gonna do is I'm gonna change this value 200 and I'll just hit the enter button and close this window and now try to give the input so because I've manipulated it I've changed a max length of the input I can give more characters as the input and let's see if it works it still didn't work that means even the name field is designed to sanitize the input now let me just modify the input so I'm gonna nest the script tag because here I can see that the script tags are being eliminated or they're being cut off so if I find a way to manipulate the script tag like I showed you and reflected cross-site scripting maybe I can execute this code so what I'm gonna do is paste the script I'll again have to change the max length you I'll change the max length 200 and then give the input and here I'll be using nested script tags similar to the way that I use in reflected cross-site scripting I'll type a message here message two and let me see if this works well it did work and because I could see from the output that the web application was designed to eliminate the script tag I just manipulated the way you inserted the script tag I use the nested script tag and then I could execute the malicious code now let's move on to the next level of security and before that I'll just clear the guestbook and I'll just increase the security go back to cross-site scripting store now again I'm gonna try the previous input the previous malicious script and see if it works I'll change them accident 200 again give the nested script tag as the input and the message would be message 1 let's see if it works ok didn't work and similar to how it was used in reflected cross-site scripting I think this code is also using regular expressions to eliminate any script tags but just to confirm I just open the code for you and see if it's actually true yes so it's same in this case so what it's doing it's basically identifying all the script tags using regular expressions and then replacing it with a blank space so it basically means that you cannot use any script tags so you need to use the alternative of the script tag now similar to the previous case like how we use in reflected cross-site scripting I'm going to use the image tag for this and before that I'll change the max length field and the input I'll be giving will be image source X on mouse-over I'll be creating a pop-up that says hello and some message here as I said the sign guestbook button so now we can see that this word but the pop-up didn't appear because the function that I use is on mouse-over so let me see if I get the mouse over on the image yes it did work so when I brought the mouse over that image you saw that the pop-up appear so this is how stored cross-site scripting can be hacked now let's move on to the next type of cross-site scripting attack that is domme cross-site scripting so dom basically stands for document object model and it is basically the way the website is designed so when you use dom cross-site scripting it is a client-side attack the script is not sent to the server or it is not stored on the server it stays on the client-side and the way this works is the webpage sends a request to the server the server sends a response the server script is executed first and this is the genuine script that the server has to execute so that is executed first and then the malicious script is executed so let's see how to use dom cross-site scripting so this is the webpage that is vulnerable to dom cross-site scripting so there are different options here there are different languages and when I select one and hit the select button nothing is seen on the webpage but you can see the URL is changed so you can see that the default is set to English now let me change the value I will hit the select button let me change the language and hit the select button you can see that the language is being changed so basically in this web page I don't have a text box where I can give the input every manipulation that I have to do or every script that I have to inject here should be done in the URL so what I'm going to do is I'm going to manipulate this so instead of giving French I'll use my malicious script here so the script will be script alert hello and we'll close the script tag when I executed it you can see that the pop-up appeared that means in dom-based crosshair scripting you mainly manipulate the URL that is being used or the URL that is being generated so this is the lower level let me increase the security I'll change it to high let me give the same input again script i lured the string is hollow and I've closed the script ah let me hit the enter button well it didn't work it actually went back to default as English so let's see what's the code behind this what's the logic behind this so what's happening here is it's finding the script tag and it's just stripping the script tag and it's setting the default to English so it means I cannot use a script tag now what if I use the nested script tag let me try that also let me nest the script I like I did in the previous stages let me nest the script tag well this also didn't work so this is web application under medium security is designed in such a way that if there's any script tag it will set the default to English the language to English now how can you bypass this for this I'm gonna inspect the element so let me see how the webpage is displaying all this data here you can see there's a form tag and there are different options here so I'm gonna make use of this syntax to inject my malicious query I'll just copy paste this so this is a line that displays English as the value so what I'm gonna do is manipulate this so the way this is designed this there's a select tag and under this there are different options English typing the whole code because I want you to understand the logic and other inputs and then the Select tag is closed and when one of the option is selected maybe English so this option is selected if I choose any different option maybe French then this line is selected and so on so what I'm gonna do is manipulate the URL in such a way that the option tags is closed earlier so basically when I choose English as a default it says English default so this part of the code is executed and this is used to close but instead of letting the page do it I'll give that as the input in the URL so what I'm going to do in the URL is I'm going to close the tag right here the option tag and the Select tag and I'm gonna use the body tag here and the function onload which has to create a prop up that says hello let me hit the enter button now as you can see here I could successfully inject the malicious code in the URL so how this works is so when I choose English as the option this part is executed so instead of the webpage closing this for me I'm adding another option tag and I'm adding another select tag so what happens is this part of the code does not execute because I am closing it here and then I'm typing my malicious script here and that's how this code successfully executed for medium security level now let me increase the security level to high and see how it works let me try the direct approach well this didn't work let me use the previous approach well this also didn't work so the webpage is designed to sanitize the URL so let me see the code for this so this cord is designed in such a way that it only takes these languages as the input and if there's anything else apart from these languages it will set the default to English now how to approach this so to pack this you need a little idea about how web pages are designed there's something called an anchor tag so anchor tags are basically used to index a particular part of the web page let me show you an example so I'll open a blog that uses the anchor tag and then explain you how this works so here you can see the URL that is Eddie Ricardo blog and the URL of the block and if you scroll down a little as usual there are different contents on the web page and what I want you to see is the index part so there are different topics that are covered in this blog and here is a list of it so what happens when I click on one of this is the web page takes me to that particular part of the web page so in case I click this it takes me to how to use networks anning tool and in case I click on types of networks scanning will take me to that part of the web page now what I want you to observe is whenever I click on one of the anchor tags the URL is regenerated to point me to that particular section of the web page I'm going to make use of this feature of web design or web development to hack our web application so what I'm going to do is I'm going to use a pound symbol or the hash symbol and then use my malicious script after that so because the pound symbol is used to index or to point to a certain page on the same website this web page will not consider it as the input it will just think that we are trying to point to a particular part in the web page so let me type hello and then close the script tag let me hit the enter button and see if this actually works well it did work so you can see that there's a pop-up that says hello and this is how you can use a pound sign or the internal anchor feature of the blocks to inject the malicious code so this is all about cross-site scripting attack we saw three types of cross-site scripting that is reflected stored and Dom and what type of cross-site scripting attack you use depends on how the web page is designed you cannot use Dom cross-site scripting on a web page that is vulnerable to stored cross-site scripting so first you have to understand how the web page works of the web application works and then decide which type of cross-site scripting attack to use now let's move on to the next topic that is how to prevent cross-site scripting attacks so the first thing you can do is escape the user input so there are special characters like greater than symbol smaller than symbol which are generally used in tags or in malicious script or maybe the percentage symbol so the first thing you can do is escaping these characters which means is that you take off the special feature of this character and make it just another text character the next thing you can do is consider all input as a thread because the user has complete control on what input he gives you have to assume that every input is a thread and sanitize and handle every input with care the next thing you can do is data validation suppose you have a field of login where you can enter user name and password what you can do is use data validation especially in case of email IDs because you know the generic format for an email ID they should be a username they should be a at the rate symbol then something then calm or dot something so you can use data validation to avoid cross-site scripting attacks next thing you have to do is sanitize the data like you saw in the demo that some of the web pages were sanitizing data they were eliminating the script tags or they were eliminating any script tag found and they were also using regular expressions to eliminate all the script tags that can be generated so this is how we can sanitize data the input data next thing you can do is encode the output so what happens is when I gave the script tag and alert as the input as the malicious the arrow symbols were being treated as the arrow symbols what he can do is you can URL encode them so the arrow symbol will be something like percent is 25 so when you encoded it's no longer a malicious script so you can use encoding URL encoding for the input or for the output next thing you can do is use the right response headers you can decide what the response header should be you can decide what data can be sent or what data can be received through the response headers and finally what you can do is use content security policies so this is a standard it is also known as CSP standards so you can use a content security policy to avoid cross-site scripting to know more about this you can just google it you can just Google content security policy to know what standards are this so that's it for today's session if you liked this video like and share and stay tuned for more videos on ethical hacking where I'll be talking about different hacking techniques until next time then bye-bye I hope you have enjoyed listening to this video please be kind enough to like it and you can comment any of your doubts and queries and we will reply them at the earliest do look out for more videos in our playlist and subscribe to Eddie rekha channel to learn more happy learning

Channel: edureka!

Views: 216,537

Keywords: yt:cc=on, ethical hacking course, ethical hacking, Ethical hacking with kali linux, Ethical hacking using kali linux, kali linux tutorial, ethical hacking tutorial, kali linux for ethical hacking, ethical hacking edureka, Cross Site Scripting, what is Cross Site Scripting, Cross Site Scripting explained, Cross Site Scripting tutorial, Cross Site Scripting attack, Cross Site Scripting demo, types of Cross Site Scripting

Id: cWu_FJUrH5Y

Length: 31min 53sec (1913 seconds)

Published: Mon Dec 09 2019