- [Instructor] Cross-site scripting attacks
are one of the most dangerous web based attacks
on the internet today.
They're easily executed by attackers,
and can take place without the knowledge of the victim.
Cross-site scripting attacks, commonly abbreviated
as XSS attacks, occur when an attacker embeds
malicious code in a third party website,
that then runs within the web browsers
of other visitors to that site.
Let's take a look at how they work.
As you may know, web pages are made using HTML code.
HTML is a markup language that allows web pages
to have all sorts of advanced functionality,
other than just displaying plain text.
HTML authors can add different fonts, include images,
link to other sites, and even include small programs
called scripts, that run in the browsers of visitors
to the site.
HTML uses the concept of tags to perform
all of these actions.
For example, the tag formats bold text.
The tag formats italicized text,
and the tag is used to include hyperlinks
in a web page.
When you're including a tag in a web page,
you write the tag inside of brackets
made using the greater than and less than signs.
You first open the tag, then include your text,
and then close the tag, by including it again,
but this time putting a forward slash in front of the tag.
Here's an example of how you would bold some text,
and it would appear like this.
How you would italicize some text,
which would appear like this.
And how you would include a link to another site,
which would then display with familiar hyperlink formatting.
I mentioned earlier that you might also want to include
some scripting in a web page, that runs a program
inside the user's browser.
You do this using the script tag.
For example, you might include this code in a web page,
that pops up a window in the reader's browser,
saying that the site is under construction.
scripting is a powerful tool, and is perfectly legitimate
when the scripts are written by the creator
of a legitimate website.
However, in a cross-site scripting attack,
the attacker manages to trick a legitimate website
into sending its users copies of a malicious script.
This often happens when the site allows users
to enter input that is then displayed to other users.
For example, an online auction site might accept postings
from anyone in the world.
Users posting to the site may wish to dress up
their auction listings with bold characters,
images, and other enhancements,
so the auction site owners allow them to write HTML code
in their listings.
Maybe someone selling a boat might want to make
their boring listing look a little more interesting
by including HTML code in their input,
and then getting a catchier looking description
that includes a picture.
But what happens if the user includes
unexpected HTML in their post,
Like a script that takes some malicious action
on the viewer's computer?
If the website simply takes this input and passes it along
to other users, the users will see the same auction listing,
but the malicious script runs in the background
without their knowledge.
Fortunately, it's easy to defend against cross-site
scripting attacks.
As with SQL injection attacks,
the key is using input validation
on any user input that includes HTML.
Specifically, the input validations should watch
for any attempts to use the script tag
in user supplied input, and remove that script code
from the input.
If you'd lik to see cross-site scripting in action,
I encourage you to watch the Security Plus
Threats and Vulnerabilities course.
In that course, I use the WebGoat application
to conduct a cross-site scripting attack
against a live website.