Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What would this look like? Can someone provide an example?

share|improve this question
    
Not all URLs look innocent without XSS attacks. They'd be easy to exploit. Google is most guilty of this: https://www.google.nl/#output=search&sclient=psy-ab&q=test+search&oq=test+searc‌​h&gs_l=hp.3..0b3.128.1072.0.1196.11.8.0.2.2.0.141.764.5z3.8.0...0.0...1c.1.9.psy-‌​ab.nJres6sEYEk&pbx=1&bav=on.3,or.r_qf.&bvm=bv.43175339,e.e2k&fp=289e1bfce01f7e5&b‌​iw=1920&bih=913 – Luc Apr 14 '13 at 10:56
up vote 5 down vote accepted

An attacker can use a URL shorting service like bit.ly:

http://bit.ly/114E7Q5

The XSS'ed site came from http://www.xssed.com/ !

If it is a phishing attack and the URL matters, then the attacker can URL-encode or UTF-8 encode key characters to obscure HTML tags. Most people disregard long urls anyway.

related: XSS filter Evasion Cheat Sheet.

share|improve this answer
5  
Link shorteners are guilty by default - at minimum guilty of annoying me. – CodesInChaos Apr 14 '13 at 9:07

I wrote a blog a while back about a security flaw in iOS's Safari Mobile browser. Which pretty much allows you to mask a URL. The hole was fixed with iOS 5.2 I believe and the hole I know for a fact is no longer available in iOS 6.x. But in short people can find such security holes in certain types of web browsers, then use them to their advantage. In the case of iOS it was pretty much just a case of using some sloppy JavaScript with iframes. Like the following.

<script type="text/javascript">
document.getElementById('one').onclick = function() {
    myWindow = window.open('http://www.apple.com', 'eintitel', 'width=200,height=100,location=yes');
    myWindow.document.write("<html><head></head><body><iframe src=\"http://techmeout.org\");></iframe></scri+pt></body></html>");
    myWindow.focus();
    return false;
}
</script>

As you can see there are two URLs: http://www.apple.com and my blog. When viewed on certain mobile Apple devices you will see www.apple.com in the address bar, but see my blog's content instead of Apple's website.

share|improve this answer

This does not have to do with XSS attacks, but it's worth mentioning the UNICODE mirror character that makes a innocent url potentially dangerous.

http://elgoog.im/search?q=moc.elgoog.www://ptth

If you check the source code of this answer, you will see that the code is:

&#8238;http://elgoog.im/search?q=moc.elgoog.www://ptth

This could be used to be redirected to a potentially bad website.

Also, if you can't click on a link, you'll have to copy and paste it. No one is going to type it in manually!

‮ http://elgoog.im/search?q=moc.elgoog.www://ptth

NOTE: The mirror character does not mirror webpage!

share|improve this answer

Cross-Site Scripting is basically code that can be input on the page for you or everyone. This is the difference of non-persistent and persistent XSS.

An example of a persistent XSS would be like (you'll need script tags):

http://www.example.com/post.php?=[post data on page]

http://www.example.com/post.php?=alert('XSS')

If this gets stored in a database and posted on the page, then everyone will see a JavaScript alert.

An example of a non-persistent XSS would be like (you'll need script tags):

http://www.example.com/search.php?=[post data on page, only for this query]

http://www.example.com/search.php?=alert('XSS')

Only people with the post data in that URL would see your alert since it wasn't stored.

share|improve this answer
1  
your payload has nothing to do with the OPs question. This isn't a 101 on XSS. – rook Apr 14 '13 at 23:48

protected by Community Apr 18 at 4:56

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.