1

I believe I was a recent victim to an XSS script that gathered my cookies; however, I am not for sure certain. I am wondering if there is any way for me to check (I removed all my cookies). Another person I know went to the same website and received a warning, but this person also has a Unified Threat Management system which I do not have. Can an attacker still receive your cookies by inserting a XSS script on a HTTPS based website? How could they receive my credit card cookie details if the website is HTTPS based?

Any advice or answers will help, thanks.

Improve this question
5
  • 1
    Is there anything except the warning your friend recieved that makes you believe there has been an XSS attack? What did the warning say?
    – Anders
    Oct 12, 2016 at 18:21
  • Didn't give much information. Just said that the website is malicious and warned him not to go to the website when he clicked the link.
    – Kev
    Oct 13, 2016 at 16:30
  • Then it is probably not XSS. It is more likely that the site has been flagged as phishing or malware infected or something like that. Is there anything in particular that makes you think it was XSS?
    – Anders
    Oct 13, 2016 at 17:23
  • Yes. When I went to the website I did not input my credentials or anything, it was for Facebook and somehow they got my CC information. And when I checked the CA on the browser it said it was legit and came from a trusted source. I then did a nslookup on the IP and it showed as facebook IP, very confusing to determine the attack for a noob like me.
    – Kev
    Oct 13, 2016 at 18:23
  • If your credit card number was exposed, contacty our bank and cancel the card. I don't think you will be able to work out how it happend, and doing so i beyond the scope of your question and this site. However, it does not sound like it was XSS to me, and I dont know why it would even be that particular site visit. It could be anything.
    – Anders
    Oct 13, 2016 at 18:36

2 Answers 2

Reset to default
1

I don't have a specific tool in mind but something that watched network traffic and identified cookies being sent to domains other than the issuer would detect the situation you describe.

As far as the question "Can an attacker still receive your cookies by inserting a XSS script on a HTTPS based website?" the answer is "Yes." There are a number of protections in modern browsers to help prevent this but unfortunately, none of the defaults, CORS being the major one I'm thinking of, prevent data being exfiltrated without at least some developer involvement.

The two major things a site developer should do to prevent cookie exfiltration are:

  • use the HttpOnly flag when setting a cookie, which instructs the browser to not provide access to the cookie in its JavaScript engine.
  • escape all input that's displayed back on a page. This prevents the initial insertion of potentially malicious javascript.
Improve this answer
1
  • 2
    OP is asking from the perspective of a potential victim and not for countermeasures for developers.
    – Arminius
    Oct 12, 2016 at 18:15
0

I believe I was a recent victim to an XSS script that gathered my cookies; however, I am not for sure certain. I am wondering if there is any way for me to check (I removed all my cookies).

There is no easy way to check if you as a site visitor, not a webadmin has been the victim of an XSS attack.

If it was a reflected attack (which means that the payload would be in the URL) you can look through your browsing history and see if you find anything that looks like and XSS payload in the URL:s to the site in question that you have visited.

If it was a stored attack, you would have to go through the source code of the pages you have visited and try to determine what the code does and if there is any fishy things going on. That is quite a big project and would require a lot of knowledge about web development.

If you are worried specifically about cookie theft you could visit the site again (be sure not to enter any sensitive info) and see what cookies it set, and if they are marked with HttpOnly. If they are, they can not be stolen with XSS. However, there are many other evil things (like keylogging) that you can do with XSS so I am not sure this would be a meaningful exercise.

Can an attacker still receive your cookies by inserting a XSS script on a HTTPS based website?

HTTPS does not protect against XSS in any way - it is not what it is designed to do. HTTPS protects your data from sniffing or fiddling while in transit from the server to the client. XSS, on the other hand, fools the server to send you a script before the data reaches the TLS layer and is encrypted.

How could they receive my credit card cookie details if the website is HTTPS based?

See above. But it important to understand that credit cards should never be stored in cookies. Doing so is a horrible practice, and I would guess a violation of PCI. (That does not mean XSS could not be used to steal credit card details - it can, even if the info is not in cookies.)

Any advice or answers will help, thanks.

My answer might not be very encouraging for you. The short version is that it is very hard for you to know if you have been the victim of an XSS attack.

So what I would do instead is contact the site in question, explain to them why you are worried (e.g. about the warning your friend recieved) and ask them if they are aware of any problems.

Some other precautions you can take is:

  • Change your password on the site.
  • If you can check your login history (or any other history of actions like purchases), do so and see if there are anything you did not do.
Improve this answer
1
  • Wow thanks very much for this information, unfortunately I had the learn the hard way. If it wasn't for me having my security + I wouldn't of known how my CC details were stolen.
    – Kev
    Oct 13, 2016 at 19:57

Not the answer you're looking for? Browse other questions tagged .