Lecture 28 - Web security: Cross-site scripting and other browser-side exploits. The goals of this chapter are: JavaScript for handling cookies in your browser, server-side cross-site scripting vs. client-side cross-site scripting, client-side cross-site scripting attacks, heap spray attacks, the w3af framework for testing web applications. | Lecture 28: Web Security: Cross-Site Scripting and Other Browser-Side Exploits Lecture Notes on “Computer and Network Security” by Avi Kak (kak@) April 19, 2016 12:16am c 2016 Avinash Kak, Purdue University Goals: • JavaScript for handling cookies in your browser • Server-side cross-site scripting vs. client-side cross-site scripting • Client-side cross-site scripting attacks • Heap spray attacks • The w3af framework for testing web applications CONTENTS Section Title Page Cross-Site Scripting — Once Again 3 JavaScript: Some Quick Highlights 5 Managing Cookies with JavaScript 9 Getting JavaScript to Download Information from a Server 22 Exploiting Browser Vulnerabilities 29 Stealing Cookies with a Cross-Site Scripting Attack 31 The Heap Spray Exploit 39 The w3af Framework for Testing a Web Application for Its Vulnerabilities 47 2 Computer and Network Security by Avi Kak Lecture 28 : Cross-Site Scripting — Once Again • Earlier in Section of Lecture 27 you saw an example of a server-side cross-site scripting attack through server-side injection of malicious code. In this section here, I will now give an example of a client-side cross-site scripting attack. • As mentioned in Lecture 27, a cross-site scripting attack, abbreviated as XSS, commonly involve three parties. For the server-side XSS, the three parties are the attacker, a web-hosting service, and an innocent victim whose web browser is being exploited. • For the client-side XSS, we again have three parties: an attacker whose goal is to get an innocent victim to click on a JavaScript bearing URL in order to cause the victim’s browser to exfiltrate the cookies to a third party or to download malicious browser exploiting code from third parties. A client-side XSS is an example of UXSS, which stands for Universal XSS. [See the paper “Subverting Ajax” by Stefano Di Paola and Giorgio Fedon for other examples of UXSS. .
