« connection gate internet proxy

crushspot myspace proxy site web »

Cross-site scripting

From Wikipedia, the free encyclopedia Jump to: navigation, search

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications that enables attackers to inject client-side script into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy. Cross-site scripting carried out on websites were roughly 80% of all security vulnerabilities documented by Symantec as of 2007. Their effect may range from a petty nuisance to a significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner.

This article may require cleanup to meet Wikipedia's quality standards. Please improve this article if you can. The talk page may contain suggestions. (May 2011)

Contents 1 Background 2 History 3 Types 3.1 Non-persistent 3.2 Persistent 3.3 Traditional versus DOM-based vulnerabilities 4 Exploit scenarios 5 Mitigation 5.1 Contextual Output Encoding/Escaping of String Input 5.2 Safely Validating Untrusted HTML Input 5.3 Cookie security 5.4 Disabling scripts 5.5 Emerging defensive technologies 6 Scanning service 7 Related vulnerabilities 8 Notes 9 See also 10 External links

Background

Cross-site scripting holes are web-application vulnerabilities which allow attackers to bypass client-side security mechanisms normally imposed on web content by modern browsers. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access privileges to sensitive page-content, session cookies, and a variety of other information maintained by the browser on behalf of the user. Cross-site scripting attacks are therefore a special case of code injection.

The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack site, in a manner that executes a fragment of JavaScript prepared by the attacker in the security context of the targeted domain (a reflected or non-persistent XSS vulnerability). The definition gradually expanded to encompass other modes of code injection, including persistent and non-JavaScript vectors (including Java, ActiveX, VBScript, Flash, or even pure HTML), causing some confusion to newcomers to the field of information security.

XSS vulnerabilities have been reported and exploited since the 1990s. Prominent sites affected in the past include the social-networking sites Twitter, Facebook, MySpace, and Orkut. In recent years, cross-site scripting flaws surpassed buffer overflows to become the most common publicly-reported security vulnerability, with some researchers viewing as many as 68% of websites as likely open to XSS attacks.

History

Prior to 2005, the vast majority experts and developers paid little attention to XSS. The focus transfixed on buffer overflows, botnets, viruses, worms, spyware, and others. Meanwhile a million new Web servers appear globally each month turning perimeter firewalls into swiss cheese and rendering Secure Sockets Layer (SSL) as quaint. Most believed JavaScript, the enabler of XSS, to be a toy programming language. It can't root an operating system or exploit a database, so why should I care? How dangerous could clicking on a link or visiting a Web page really be? In October 2005, we got the answer. Literally overnight the Samy Worm, the first major XSS worm, managed to shut down the popular social networking Web site MySpace. The payload being relatively benign, the Samy Worm was designed to spread from a single MySpace user profile page to another, finally infecting more than a million users in only 24 hours. Suddenly the security world was wide-awake and research into JavaScript malware exploded. XSS is very dangerous because it can lead to compromising your system or your network.

Types

There is no single, standardized classification of cross-site scripting flaws, but most experts distinguish between at least two primary flavors of XSS: non-persistent and persistent. Some sources further divide these two groups into traditional (caused by server-side code flaws) and DOM-based (in client-side code).

Non-persistent

Example of non-persistent XSS
Non-persistent XSS vulnerabilities in Google Nothing was found! Even more about cookie no no proxy script Media Network sponsored MetaCrawler	Msnsearchcanada.com 41g.net Info-stars.com Greatest-tattoos.com Startsurveynow.com Intertruc.com Sexy-tattoo.com © 2006–2007 spinsurf.net Valid XHTML | CSS — Sitemap