Like server-side scripts, client-side scripts can also accept and manipulate user input with the help of DOM.
Here is a very simple HTML code that accepts and writes user input using JavaScript with the help of DOM.
<html>
<head>
</head>
<body>
<script>
var pos=document.URL.indexOf("BTSinput=")+9; //finds the position of value
var userInput=document.URL.substring(pos,document.URL.length); //copy the value into userInput variable
document.write(unescape(userInput)); //writes content to the webpage
</script>
</body>
</html>
If you know HTML and JavaScript, understanding the above code is a piece of cake.
In the above example, the JavaScript code gets value from the URL parameter "BTSinput" and writes the value in our web page.
For example, if the URL is
www.BreakThesecurity.com/PenTesting?BTSinput=default.
The web page will display "default" as output.
Did you notice ?! The part of the webpage is not written by Server-side script. The client side script modifies the content dynamically based on the input. Everything done with the help of DOM object 'document'.
DOM Based XSS vulnerability:
When a developer writes the content using DOM object without sanitizing the user input , it allow an attacker to run his own code.
In above example, we failed to sanitize the input and simply displayed the whatever value we get from the url.
An attacker with malicious intention can inject a xss vector instead . For example:
DOM Based XSS vulnerability:
When a developer writes the content using DOM object without sanitizing the user input , it allow an attacker to run his own code.
In above example, we failed to sanitize the input and simply displayed the whatever value we get from the url.
An attacker with malicious intention can inject a xss vector instead . For example:
www.BreakThesecurity.com/PenTesting?BTSinput=<script>alert("BreakTheSec")</script>
As i said earlier, the document.write function simply writes the value
of BTSinput parameter in the webpage. So it will write the
'<script>alert("BreakTheSec")</script>' in the webpage
without sanitizing. This results in running the script code and
displays the alert box.
Patching the DOM Based Cross Site Scripting VulnerabilityAudit all JavaScript code in use by your application to make sure that untrusted data is being escaped before being written into the document, evaluated, or sent as part of an AJAX request. There are dozens of JavaScript functions and properties which must be protected, including some which are rather non-obvious:
The document.write() function
The document.writeln() function
The eval() function, which executes JavaScript code from a string
The execScript() function, which works similarly to eval()
The setInterval(), setTimeout(), and navigate() functions
No comments:
Post a Comment