What is XSS and how do you protect yourself

What Is Cross-Site Scripting (XSS)?

XSS is a security abbreviation for Cross Site Scripting. Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. In recent years, XSS vulnerabilities have become one of the most prevalent exploited security vulnerabilities. Approximately 12.75% of all web vulnerabilities are XSS related.

How Does An XSS Attack Work?

Step #1 Hackers design a malicious script usually with the purpose of mining user data like usernames, passwords or billing details.

Step #2 Hackers inject the malicious script into a legitimate website, the script acts as a hidden layer to the user, similar to the concept behind an illicit ATM Skimmer.

Step #3 Hackers then receive feedback from the script, successfully harvesting user data.

Types Of XSS Attacks:

1. Reflected Attack (Type-II XSS / Non-Persistent XSS): A reflected Attack is where the injected script is reflected off a web server as a request, such as a normal search result, error message or subsequent link. Reflected attacks target users differently, often masquerading in emails or hidden links. The browser executes the code because it came from a ‘trusted’ server.

2. Stored Attack (Type-I XSS / Persistent XSS): A stored Attack is the script that is injected and stored on the target servers, such as in a comment, database or forum. The script may then be executed while a legitimate user is using the site.

 

How to Determine If You Are Vulnerable:

XSS flaws can be difficult to identify and remove from a web application. The best way to find flaws is to perform a security review of the code and search for all places where input from an HTTP request could possibly make its way into the HTML output. Note that a variety of different HTML tags can be used to transmit a malicious JavaScript. Nessus, Nikto, and some other available tools can help scan a website for these flaws, but can only scratch the surface. If one part of a website is vulnerable, there is a high likelihood that there are other problems as well.

Mitigation

1. Blacklisting & White listing: Two very basic techniques you can use to sanitize incoming data similar to that of parameter inputs for migrating SQL Injection Attacks; White listing uses a list of approved data, that can only be executed. White listing is the most secure. Blacklisting uses a list of prohibited data to exclude from execution.

2. Application Security: At its core Barricade works like an early warning system against any attempts at breaching the security of your servers. By using attack mitigation products like Barricade you can be a step ahead of the game. Barricade quietly watches in the background and can identify any security threats. In the event, there is any serious activity Barricade notifies you and provide detailed steps needed to solve the situation.

3. HTTP trace off: Also, it's crucial that you turn off HTTP TRACE support on all web servers. An attacker can steal cookie data via Javascript even when document. Cookie is disabled or not supported on the client. This attack is mounted when a user posts a malicious script to a forum so when another user clicks the link, an asynchronous HTTP Trace call is triggered which collects the user's cookie information from the server, and then sends it over to another malicious server that collects the cookie information so the attacker can mount a session hijack attack. This is easily mitigated by removing support for HTTP TRACE on all web servers.

4. Prevention of XSS can be found in here: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet