Cross-Site Scripting (XSS)
Cross-Site Scripting (XSS) Explained - PwnFunction
An origin consists of a URI scheme, domain and port number. For example, consider the following URL:
This uses the scheme
http, the domain
normal-website.com, and the port number
80. The following table shows how the same-origin policy will be applied if content at the above URL tries to access other origins:
This means that the response will be generated within the user's session, and include any relevant data that is specific to the user. Without SOP, if you visited a malicious website, it would be able to read your emails from GMail, private messages from Facebook, etc.
There are three main types of XSS attacks. These are:
- 1.Reflected XSS, where the malicious script comes from the current HTTP request.
- 2.Stored XSS, where the malicious script comes from the website's database.
- 3.DOM-based XSS, where the vulnerability exists in client-side code rather than server-side code.
Reflected XSS arises when an application receives data in an HTTP request and includes that data within the immediate response in an unsafe way. Here is a simple example of a reflected XSS vulnerability:
<p>Status: All is well.</p>
The application doesn't perform any other processing of the data, so an attacker can easily construct an attack like this:
<p>Status: <script>/* Bad stuff here... */</script></p>
If the user visits the URL constructed by the attacker, then the attacker's script executes in the user's browser, in the context of that user's session with the application. At that point, the script can carry out any action, and retrieve any data, to which the user has access.
Stored XSS arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way.
The data in question might be submitted to the application via HTTP requests. For example:
- Comments on a blog post
- User nicknames in a chat room
- Contact details on a customer order
In other cases, the data might arrive from other untrusted sources. For example:
- A webmail application displaying messages received over SMTP
- A marketing application displaying social media posts
- A network monitoring application displaying packet data from network traffic.
Here is a simple example of a stored XSS vulnerability. A message board application lets users submit messages, which are displayed to other users:
<p>Hello, this is my message!</p>
The application doesn't perform any other processing of the data, so an attacker can easily send a message that attacks other users:
var search = document.getElementById('search').value;
var results = document.getElementById('results');
results.innerHTML = 'You searched for: ' + search;
If the attacker can control the value of the input field, they can easily construct a malicious value that causes their own script to execute:
You searched for: <img src=1 onerror=alert(1337)>
In a typical case, the input field would be populated from part of the HTTP request, such as a URL query string parameter, allowing the attacker to deliver an attack using a malicious URL, in the same manner as reflected XSS.
HttpOnlyis an additional flag included in a
Set-CookieHTTP response header. Using the
Set-Cookie: session=13371337 ; HttpOnly
HttpOnlyflag is included in the HTTP response header, the cookie cannot be accessed through client side script (again if the browser supports this flag). As a result, even if XSS exists, and a user accidentally accesses a link that exploits this flaw, the browser (primarily Internet Explorer) will not reveal the cookie to a third party.
CSP is a browser security mechanism that aims to mitigate XSS and some other attacks. It works by restricting the resources (such as scripts and images) that a page can load and restricting whether a page can be framed by other pages.
To enable CSP, a response needs to include an HTTP response header called
Content-Security-Policywith a value containing the policy. The policy itself consists of one or more directives, separated by semicolons.