Cross Site Scripting Attack

What is Cross site Scripting?

Hackers are constantly experimenting with a wide repertoire of hacking techniques to

compromise websites and web applications and make off with a treasure trove of sensitive data
including credit card numbers, social security numbers and even medical records.

Cross Site Scripting (also known as XSS or CSS) is generally believed to be one of the most
common application layer hacking techniques.

In general, cross-site scripting refers to that hacking technique that leverages vulnerabilities in
the code of a web application to allow an attacker to send malicious content from an end-user
and collect some type of data from the victim.

Today, websites rely heavily on complex web applications to deliver different output or content
to a wide variety of users according to set preferences and specific needs. This arms
organizations with the ability to provide better value to their customers and prospects.
However, dynamic websites suffer from serious vulnerabilities rendering organizations helpless
and prone to cross site scripting attacks on their data.

"A web page contains both text and HTML markup that is generated by the server and
interpreted by the client browser. Web sites that generate only static pages are able to have full
control over how the browser interprets these pages. Web sites that generate dynamic pages
do not have complete control over how their outputs are interpreted by the client. The heart of
the issue is that if mistrusted content can be introduced into a dynamic page, neither the web
site nor the client has enough information to recognize that this has happened and take
protective actions." (CERT Coordination Center).

Cross Site Scripting allows an attacker to embed malicious JavaScript, VBScript, ActiveX, HTML,
or Flash into a vulnerable dynamic page to fool the user, executing the script on his machine in
order to gather data. The use of XSS might compromise private information, manipulate or steal
cookies, create requests that can be mistaken for those of a valid user, or execute malicious
code on the end-user systems. The data is usually formatted as a hyperlink containing malicious
content and which is distributed over any possible means on the internet.

As a hacking tool, the attacker can formulate and distribute a custom-crafted CSS URL just by
using a browser to test the dynamic website response. The attacker also needs to know some
HTML, JavaScript and a dynamic language, to produce a URL which is not too suspicious-
looking, in order to attack a XSS vulnerable website.
Any web page which passes parameters to a database can be vulnerable to this hacking
technique. Usually these are present in Login forms, Forgot Password forms, etc…

How to check for Cross site scripting vulnerabilities

To check for Cross site scripting vulnerabilities, use a Web Vulnerability Scanner. A Web
Vulnerability Scanner crawls your entire website and automatically checks for Cross Site
Scripting vulnerabilities. It will indicate which URLs/scripts are vulnerable to these attacks so
that you can fix the vulnerability easily. Besides Cross site scripting vulnerabilities a web
application scanner will also check for SQL injection & other web vulnerabilities.

Preventing Cross Site Scripting attacks

To prevent these attacks, dangerous characters must be filtered out from the web application
inputs. These should be filtered out both in their ASCII and HEX values.