Scrubbing Your AJAX

What is Cross Site Scripting
Cross Site Scripting (XSS) is a security exploit where
malicious scripts are injected into the URL (query strings?) or
form fields of a site and then run by unsuspecting victims.
Reflected
Stored
Local

Hacker Persuades Victim to click on a URL
Victim Clicks Link
Script Embedded in URL Steals Sensitive Info

Hacker

Victim

<HTML>
<HEAD>
<TITLE>Search Example</TITLE>
<META http-equiv=quot;content-typequot; content=quot;text/html; charset=utf-8quot;>
</HEAD>
<BODY> <H1>Search Results</H1> for <SCRIPT>alert(quot;Running!quot;)</SCRIPT>
<BR> <BR> <h2>Sorry, no results were found.</h2> <BR> <FORM
name=search> <INPUT type=text name=quot;keywordquot;
value=“<SCRIPT>alert("Running!")</SCRIPT> <INPUT type=submit
value=quot;Goquot;> </FORM> </BODY> </HTML>

http://myserver/search.aspx?keyword=<SCRIPT>alert(quot;Running!quot;)</SCRIPT>

Input Validation
Client side??
Request Validation Attribute
Output Encoding
HTMLEncode – Black listing
Microsoft Anti-Cross Site Scripting Library - Whitelisting

Hacker Injects Script to Datastore
When Victim visits, it is run on their machine

Hacker

Victim

First Name

Last Name

Comments

<script> Anything</script>

Hacker Injects Script to Datastore
When Victim visits, it is run on their machine

Victim
X
Hacker

<HTML>
<TITLE>Welcome!</TITLE>
Hi
<SCRIPT>
var pos=document.URL.indexOf(quot;name=quot;)+5;
document.write(document.URL.substring(pos,document.URL.length));
</SCRIPT>
<BR>
Welcome to our system
…
</HTML>

http://www.vulnerable.site/welcome.html#name=<script>alert(document.cookie)<script>

Javascript Hardening
Analyze Dom Modifications
document
window
Eval() (don’t use)
Regular Expressions
Remember
Hacker can see your javascript
Use a JSON Parser instead of Eval() (www.json.org)

© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions,
it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation.
MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Scrubbing Your AJAX

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (12)

Similar to Scrubbing Your AJAX

Similar to Scrubbing Your AJAX (20)

More from goodfriday

More from goodfriday (20)

Recently uploaded

Recently uploaded (20)

Scrubbing Your AJAX