What I learned from suffering my first and last XSS attack
livesshattack.net
What I learned from suffering my first and last XSS attack
1–10 of 43 posts
Re: What I learned from suffering my first and last XSS attack
#2Some modern tools to mitigate XSS/make XSS virtually impossible:
- Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/Security/CSP/In...
- The sandbox attribute on iframes: https://developer.mozilla.org/en/docs/Web/HTML/Element/ifram...
XSS is one of the hardest things to keep under control at scale.
Re: What I learned from suffering my first and last XSS attack
#3Some modern tools to mitigate XSS/make XSS virtually impossible: - Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/Security/CSP/In... - The sandbox attribute on iframes: https://developer.mozilla.org/en/docs/Web/HTML/Element/ifram... XSS is one of the hardest things to keep under control at scale.
jacobparker: Indeed. I added related headers to my web server conf after the fact (https://github.com/WillieStevenson/conf-files/blob/master/ng...). I should of have mentioned it in my post.
Re: What I learned from suffering my first and last XSS attack
#4Some modern tools to mitigate XSS/make XSS virtually impossible: - Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/Security/CSP/In... - The sandbox attribute on iframes: https://developer.mozilla.org/en/docs/Web/HTML/Element/ifram... XSS is one of the hardest things to keep under control at scale.
A much better way to mitigate XSS/HTML injections is not using string functions to generate HTML.
CSP prevents an attacker from executing scripts, but the attacker can still corrupt your HTML.
Re: What I learned from suffering my first and last XSS attack
#5Some modern tools to mitigate XSS/make XSS virtually impossible: - Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/Security/CSP/In... - The sandbox attribute on iframes: https://developer.mozilla.org/en/docs/Web/HTML/Element/ifram... XSS is one of the hardest things to keep under control at scale.
A much better way to mitigate XSS/HTML injections is not using string functions to generate HTML. CSP prevents an attacker from executing scripts, but the attacker can still corrupt your HTML.
Some examples detailing the dangers of HTML corruption: http://lcamtuf.coredump.cx/postxss/.
Re: What I learned from suffering my first and last XSS attack
#6Some modern tools to mitigate XSS/make XSS virtually impossible: - Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/Security/CSP/In... - The sandbox attribute on iframes: https://developer.mozilla.org/en/docs/Web/HTML/Element/ifram... XSS is one of the hardest things to keep under control at scale.
A much better way to mitigate XSS/HTML injections is not using string functions to generate HTML. CSP prevents an attacker from executing scripts, but the attacker can still corrupt your HTML.
Yep. XSS isn’t at all hard to prevent if you’re using tools that are safe by default. Unfortunately, popular ones like jQuery aren’t. (This, more than any other, is a reason to prefer the DOM API.)
Re: What I learned from suffering my first and last XSS attack
#7Some modern tools to mitigate XSS/make XSS virtually impossible: - Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/Security/CSP/In... - The sandbox attribute on iframes: https://developer.mozilla.org/en/docs/Web/HTML/Element/ifram... XSS is one of the hardest things to keep under control at scale.
I've gotten into the habit of starting off every new project of mine with the header "Content-Security-Policy: script-src 'self'" on all pages, and whitelisting domains and 'unsafe-eval' as I need them. ('unsafe-eval' isn't so bad. 'unsafe-inline' is the really unsafe one that you want to avoid because it undoes the XSS protection. Eval has legitimate uses and eval-based vulnerabilities are not anywhere near as easy to accidentally create and never notice as a regular XSS vulnerability. I'd bet that everyone who has really written Javascript+HTML without CSP has created a regular XSS vulnerability at some point.)
There's no excuse to not start new projects off with a CSP rule like that. Doing it from the start means you won't ever have to comb through your codebase later to remove all bits of inline javascript that you depend on to get the benefits.
Re: What I learned from suffering my first and last XSS attack
#8Earlier quoted context omitted.
A much better way to mitigate XSS/HTML injections is not using string functions to generate HTML. CSP prevents an attacker from executing scripts, but the attacker can still corrupt your HTML.
Yep. XSS isn’t at all hard to prevent if you’re using tools that are safe by default. Unfortunately, popular ones like jQuery aren’t. (This, more than any other, is a reason to prefer the DOM API.)
I'm not sure the DOM API is safer. innerHtml vs html()
Re: What I learned from suffering my first and last XSS attack
#9Some modern tools to mitigate XSS/make XSS virtually impossible: - Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/Security/CSP/In... - The sandbox attribute on iframes: https://developer.mozilla.org/en/docs/Web/HTML/Element/ifram... XSS is one of the hardest things to keep under control at scale.
A much better way to mitigate XSS/HTML injections is not using string functions to generate HTML. CSP prevents an attacker from executing scripts, but the attacker can still corrupt your HTML.
You can use CSP to prevent content exfiltration as well, not just script execution. There's a number of directives suited for that: img-src, form-action, child-src, etc. Full list on MDN: https://developer.mozilla.org/en-US/docs/Web/Security/CSP/CS...
Re: What I learned from suffering my first and last XSS attack
#10Some modern tools to mitigate XSS/make XSS virtually impossible: - Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/Security/CSP/In... - The sandbox attribute on iframes: https://developer.mozilla.org/en/docs/Web/HTML/Element/ifram... XSS is one of the hardest things to keep under control at scale.
One of the projects I'm working on aims to make it easier to integrate CSP headers into web applicatons.
https://github.com/paragonie/csp-builder
I'm working this week to integrate it into another project we're developing. (It's MIT licensed, so have fun with it.)