7

I am learning about XSS attacks. Wikipedia says that in a non-persistent attack an attacker may provide an innocent-looking URL that "points to a trusted site but actually has an XSS vector." What would this look like? Can someone provide an example?

Improve this question
1
  • Not all URLs look innocent without XSS attacks. They'd be easy to exploit. Google is most guilty of this: https://www.google.nl/#output=search&sclient=psy-ab&q=test+search&oq=test+search&gs_l=hp.3..0b3.128.1072.0.1196.11.8.0.2.2.0.141.764.5z3.8.0...0.0...1c.1.9.psy-ab.nJres6sEYEk&pbx=1&bav=on.3,or.r_qf.&bvm=bv.43175339,e.e2k&fp=289e1bfce01f7e5&biw=1920&bih=913
    – Luc
    Apr 14, 2013 at 10:56

4 Answers 4

Reset to default
5

An attacker can use a URL shorting service like bit.ly:

http://bit.ly/114E7Q5

The XSS'ed site came from http://www.xssed.com/ !

If it is a phishing attack and the URL matters, then the attacker can URL-encode or UTF-8 encode key characters to obscure HTML tags. Most people disregard long urls anyway.

related: XSS filter Evasion Cheat Sheet.

Improve this answer
1
  • 5
    Link shorteners are guilty by default - at minimum guilty of annoying me.
    – CodesInChaos
    Apr 14, 2013 at 9:07
9

I wrote a blog a while back about a security flaw in iOS's Safari Mobile browser. Which pretty much allows you to mask a URL. The hole was fixed with iOS 5.2 I believe and the hole I know for a fact is no longer available in iOS 6.x. But in short people can find such security holes in certain types of web browsers, then use them to their advantage. In the case of iOS it was pretty much just a case of using some sloppy JavaScript with iframes. Like the following. 

<script type="text/javascript">
document.getElementById('one').onclick = function() {
    myWindow = window.open('http://www.apple.com', 'eintitel', 'width=200,height=100,location=yes');
    myWindow.document.write("<html><head></head><body><iframe src=\"http://techmeout.org\");></iframe></scri+pt></body></html>");
    myWindow.focus();
    return false;
}
</script>

As you can see there are two URLs: http://www.apple.com and my blog. When viewed on certain mobile Apple devices you will see www.apple.com in the address bar, but see my blog's content instead of Apple's website.

Improve this answer
0
1

Cross-Site Scripting is basically code that can be input on the page for you or everyone. This is the difference of non-persistent and persistent XSS.

An example of a persistent XSS would be like (you'll need script tags):

http://www.example.com/post.php?=[post data on page]

http://www.example.com/post.php?=alert('XSS')

If this gets stored in a database and posted on the page, then everyone will see a JavaScript alert.

An example of a non-persistent XSS would be like (you'll need script tags):

http://www.example.com/search.php?=[post data on page, only for this query]

http://www.example.com/search.php?=alert('XSS')

Only people with the post data in that URL would see your alert since it wasn't stored.

Improve this answer
1
  • 1
    your payload has nothing to do with the OPs question. This isn't a 101 on XSS.
    – rook
    Apr 14, 2013 at 23:48
1

This does not have to do with XSS attacks, but it's worth mentioning the UNICODE mirror character that makes a innocent url potentially dangerous.

‮ http://elgoog.im/search?q=moc.elgoog.www://ptth

If you check the source code of this answer, you will see that the code is:

&#8238;http://elgoog.im/search?q=moc.elgoog.www://ptth

This could be used to be redirected to a potentially bad website.

Also, if you can't click on a link, you'll have to copy and paste it. No one is going to type it in manually!

‮ http://elgoog.im/search?q=moc.elgoog.www://ptth

NOTE: The mirror character does not mirror webpage!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .