From 4b8b2243c315c2f589afb91eebee8078501c8fe4 Mon Sep 17 00:00:00 2001 From: Ken Johnson Date: Thu, 23 May 2013 16:59:36 -0400 Subject: [PATCH] refactored xss --- .../layouts/tutorial/xss/_xss_first.html.erb | 81 +++++++++++++++++ app/views/tutorials/xss.html.erb | 86 +------------------ 2 files changed, 84 insertions(+), 83 deletions(-) create mode 100644 app/views/layouts/tutorial/xss/_xss_first.html.erb diff --git a/app/views/layouts/tutorial/xss/_xss_first.html.erb b/app/views/layouts/tutorial/xss/_xss_first.html.erb new file mode 100644 index 0000000..ae77a52 --- /dev/null +++ b/app/views/layouts/tutorial/xss/_xss_first.html.erb @@ -0,0 +1,81 @@ +
+
+
+ A2 - Cross-Site Scripting ("XSS") +
+
+
+
+
+
+ + + + Description + +
+
+
+

XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation and escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

+
+
+
+
+
+ + + + Bug + +
+
+
+

Stored Cross-Site Scripting - The following code was taken from app/views/layouts/shared/_header.html.erb

+ +

+ 

+					  <%= @code %>
+
+

+ +
+
+
+
+
+ + + + Solution + +
+
+
+

Stored Cross-Site Scripting ATTACK:

+ +

When registering, enter your JavaScript tag such as <%= %{