8/3/2019 A Simple Guide to Cross Site Scripting

1/20

8/3/2019 A Simple Guide to Cross Site Scripting

2/20

?$Mdp|a`xgpmad pa G|aww Wmph Wg|mzpmdi

&VWW-

8/3/2019 A Simple Guide to Cross Site Scripting

3/20

' Mp mw G|aww Wmph Wg|mzpmdi `adp ihpgadcxwh` ympf Gowgo`mdi Wp}nh Wfhhpw$

' Mp mw pfh sh|} gabbad oppoge caxd` mdyhl"ozznmgopmadw od` onnayw pfh oppogeh|pa mdwh|p bonmgmaxw ga`h$

' Mp mw pfh Gnmhdp wm`h oppoge yfmgf nhpw pfhoppogeh| pa goxwh `oboih pa }ax| yhlwmph$

' Mp onnayw pfh oppogeh|w pa l}zoww pfh gnmhdpwm`h whgx|mp} bhgfodmwb$

8/3/2019 A Simple Guide to Cross Site Scripting

4/20

' Pfh gadghzp ac VWW mw pa bodmzxnophgnmhdp"wm`h wg|mzpw ac o yhl ozznmgopmad pa

hvhgxph md pfh boddh| `hwm|h` l} pfhbonmgmaxw xwh|$' VWW mw pfh z|aghww ac mdkhgpmdi KosoWg|mzp

&bomdn}- od` onwa FPBN &FPBN

Mdkhgpmad- mdpa o yhlwmph pa ihp `hwm|h`axpzxp l} oppogeh|$

' Pfh Bawp Gabbad Axpzxp o oppogeh|

dhh` mw gaaemhw$

8/3/2019 A Simple Guide to Cross Site Scripting

5/20

Gaaemhw;O gaaemh mw kxwp adh a| ba|h zmhghw ac mdca|bopmad

wpa|h` ow phvp wp|mdiw ad }ax| bogfmdh$ O Yhl

Wh|sh| whd`w }ax o gaaemh od` pfh l|aywh|wpa|hw mp$ Pfh l|aywh| pfhd |hpx|dw pfh gaaemh papfh wh|sh| pfh dhvp pmbh pfh zoih mw |hch|hdgh`$Gaaemhw onwa fhnzw pa wpa|h }ax| naimd

g|h`hdpmonw$ Ympfaxp gaaemhw }ax godp wo}naiih` md ad wmphw$

ZFZWHWWM@ mw pfh lowmg gaaemh yfmgf mw kxwp}ax| whwwmad ad o ZFZ zoih$

8/3/2019 A Simple Guide to Cross Site Scripting

6/20

Dad"Zh|wmwphdp;

Bawp Gabbad p}zh ac VWW

Zh|wmwphdp;@odih|axw od` Zh|bodhdpp}zh ac VWW

8/3/2019 A Simple Guide to Cross Site Scripting

7/20

Dad"Zh|wmwphdp;Mp bhodw pfop pfh mdkhgph` ga`h mw dap

zh|bodhdp od` mw ca| wbonn pmbh pmnn pfh xwh|mw ad zoih a| fosmdi pfh x|n ympf bonmgmaxwga`h$

Pfh lhwp yo} pa mbznhbhdp dad"zh|wmwphdpvww mw ad lowmg ga`h` who|gf lav a| who|gfhdimdh$FPBN od` Kosowg|mzp ga`hw o|h hvhgxph`$

8/3/2019 A Simple Guide to Cross Site Scripting

8/20

'Hvobznh wmph ympf o who|gf hdimdh$

Zawp Bhpfa`;fppz;!!yyy$wmphdobh$gab!who|gf$zfz&Mdwh|p Ga`h md who|gf lav-Ga`h; >wg|mzp4onh|p&!fogeh`!->!wg|mzp4

Ihp Bhpfa`;fppz;!!yyy$wmphdobh$gab!who|gf$zfz1who|gf2>wg|mzp

4onh|p&!fogeh`!->!wg|mzp4

8/3/2019 A Simple Guide to Cross Site Scripting

9/20

Zh|wmwphdp;Mp bhodw pfop pfh mdkhgph` ga`h mw zh|bodhdp

od` ymnn wpo} ad pfh wmph od` axpzxp god lhwhhd l} od} xwh| ac wmph$Pfhwh emd` ac oppoge god lh mbznhbhdph` ad

Lnaiw. Wfaxplavhw. Z|acmnhw. Ca|xbw.gabbhdp lav. phwpmbadmon zoih. kxwp bawpznoghw yfh|h }ax mdwh|p `opo od` mp wpo}wpfh|h$

8/3/2019 A Simple Guide to Cross Site Scripting

10/20

Zh|wmwphdp;Pfh xwh|!oppogeh| gaxn` howmn} mdwh|pbonmgmaxw ga`h md wmph pa zaz xz bhwwoih.`hcogmdi. gaaemh i|ollmdi hpg$

Hvobznh Ga`h ca| zaz"xz bhwwoih;

>wg|mzp4onh|p&!Fogeh`!->!wg|mzp4

"4Yfhd oppogeh| mdwh|p pfmw ga`h md wabh mdzxp lavod` pfh axpzxp ymnn lh !Fogeh`! yfhd hsh| wabh

smwmpw pfh zoih

8/3/2019 A Simple Guide to Cross Site Scripting

11/20

' Lhwp yo} pa gfhge vww mw bodxonn} l} cmd`mdi wmphwod` mdwh|pmdi pfh wfa|p ga`h pa ihp axpzxp$?$ >wg|mzp4onh|p&foge->!wg|mzp4

f?4fogeh`>!f?4

' ]ax god ia ca| ; Who|gf Lav

Lnaiw WfaxpLav Gabbhdp Lav Naimd Lav

Chh`loge Ca|bw

8/3/2019 A Simple Guide to Cross Site Scripting

12/20

Md gaaemhw wphonmdi z|aghww yh god ihp pfh`hpomnw ac pfh smgpmb nmeh;' MZ O``|hww

' L|aywh|

' @oph od` Pmbh

' \hcch|h| Nmde

8/3/2019 A Simple Guide to Cross Site Scripting

13/20

Hvobznh ac zfz wg|mzp yfmgf ogghzpw gaaemhw$>1zfzfho`h|&,Nagopmad; fppz;!!yyy$iaainh$gab,-5gaaemh 2 QIHPU)gaaemh)R5

cmnh 2 cazhd&,naiw$pvp,. ,o,-5`opxb 2 oph&)`"b"] ! F;m;w)-5mz 2 QWH\SH\U)\HBAPHQO@@\)R5fppz|hcm2 QWH\SH\U)FPPZQ\HCH\H\)R5fppzoihdp2 QWH\SH\U)FPPZQXWH\QOIHDP)R5

cy|mph&cmnh. ,^|^dXwh| @hpomnw ;" ^|^d"4 MZ O``|hww; mz^|^d"4 @oph;`opxb &@oph2%8$7: IPB-^|^d"4 L|aywh|; fppzoihdp^|^d"4 \hcch|on;fppz|hcm^|^d Gaaemhw; gaaemh ^|^d""22UPfdv Ca| Xwmdi Mp ;- R22""^d, -5cgnawh&cmnh-5hvmp5

14

8/3/2019 A Simple Guide to Cross Site Scripting

14/20

Ya|emdi;' Nhpw owwwxbh pfop yh iap o wmph sxndh|olnhpa zh|wmwphdp vww od` pfh wmph onwa fosh naimd

cogmnmp}$' Yh ymnn mdzxp pfh ga`h md pfh lav yfh|h yhiap sxndh|olmnmp}$

Ga`h; >wg|mzp4`agxbhdp$nagopmad 2 )fppz;!!}ax|wmph$gab!wphon$zfz1gaaemh ) %`agxbhdp$gaaemh5>!wg|mzp4

8/3/2019 A Simple Guide to Cross Site Scripting

15/20

Ya|emdi;Day yfhdhsh| wabhadh smhyw pfop zoihyfh|h yh o``h` ax| bonmgmaxw ga`h ca| gaaemh

i|ollmdi ymnn i|ol pfh gaaemh ac pfh xwh| mdnaiw$pvp cmnh a| ow x dobh` pfh cmnh od` mp ymnn|h`m|hgp pfh xwh| pa pfh wmph }ax bhdpmadh` md

zfz cmnh ow m fosh bhdpmadh yyy$iaainh$gab

Daph; Mc pfh ga`h ahwdp ya|e mp bhodw yhfosh pa l}zoww pfh cmnph|$

8/3/2019 A Simple Guide to Cross Site Scripting

16/20

' Pa @hcogh pfh wmph xwmdi VWW }ax kxwp dhh`o zh|wmwphdp sxndh|olmnmp}$

' Pfmw god lh `adh l} mdwh|pmdi FPBNMdkhgpmad Ga`h pa pfh wmph$

' ]ax god hshd o`` mboihw. cnowf sm`haw od`z|h"bo`h fpbn zoihw l} mc|obh ga`h$

8/3/2019 A Simple Guide to Cross Site Scripting

17/20

Hvobznh Ga`hw;

'@hcogmdi L} Mboih;>MBI W\G2,fppz;!!wmph$gab!fogeh`$zdi,4' @hcogmdi L} fpbn Zoih;>mc|obh w|g2fppz;!!wmph!zoih$fpbn4>!mc|obh4'@hcogmdi L} mdwh|pmdi Cnowf Cmnh;>HBLH@ W\G2fppz;!!wmph!fogeh`$wyc4' \h`m|hgpmdi pa }ax| wmph;>wg|mzp4ymd`ay$azhd& ,fppz;!!yyy$wmph$gab!,

->!wg|mzp4

8/3/2019 A Simple Guide to Cross Site Scripting

18/20

' L}zoww Cmnph|w fhnzw pa wpaz vww oppogew adyhlwmph$

' Pfhwh cmnph|w fhnz o`bmd l} dap hvhgxpmdiwabh ya|`w # gfo|ogph|w yfmgf o|h xwh` mdVWW oppoge$

' Pa l}zoww pfhwh cmnph|w }ax god gfodih pfhgfo|ogph|w ac pfh wg|mzp$

8/3/2019 A Simple Guide to Cross Site Scripting

19/20

Hvobznh Ga`hw;

A|mimdon;>wg|mzp4onh|p&!fogeh`!)->!wg|mzp4Gfodih` Ga`h;>wG|MzP4oNh\p&!fogeh`!)->!Wg\mZp4

A|mimdon;>bo|qxhh4>f?4VWW>!f?4>!bo|qxhh4Gfodih` Ga`h;),44>bo|qxhh4>f?4VWW>!f?4>!bo|qxhh4

8/3/2019 A Simple Guide to Cross Site Scripting

20/20

@hsmd`h| Ia}onG}lh| Whgx|mp} od` Odpm Fogemdi A|iodmwopmad&Bhblh| Whg|hpo|}-

H"bomn; `hsmd`h|ia}onJibomn$gab

Zfadh;%=?"=69