GSMcNamara
94 lines
4.7 KiB
Plaintext
Executable File
94 lines
4.7 KiB
Plaintext
Executable File
<div class="widget">
|
||
<div class="widget-header">
|
||
<div class="title">
|
||
<span class="fs1" aria-hidden="true" data-icon=""></span> A2 - Cross-Site Scripting ("XSS")
|
||
</div>
|
||
</div>
|
||
<div class="widget-body">
|
||
<div id="accordion1" class="accordion no-margin">
|
||
<div class="accordion-group">
|
||
<div class="accordion-heading">
|
||
<a href="#collapseOne" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
|
||
<i class="icon-info icon-white">
|
||
</i>
|
||
Description
|
||
</a>
|
||
</div>
|
||
<div class="accordion-body in collapse" id="collapseOne" style="height: auto;">
|
||
<div class="accordion-inner">
|
||
<p>XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation and escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.</p>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div class="accordion-group">
|
||
<div class="accordion-heading">
|
||
<a href="#collapseTwo" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
|
||
<i class="icon-bug icon-white">
|
||
</i>
|
||
Bug
|
||
</a>
|
||
</div>
|
||
<div class="accordion-body collapse" id="collapseTwo" style="height: 0px;">
|
||
<div class="accordion-inner">
|
||
<p><b>Stored Cross-Site Scripting - The following code was taken from app/views/layouts/shared/_header.html.erb</b></p>
|
||
|
||
<p>
|
||
<pre class="ruby">
|
||
<%= @code %>
|
||
</pre>
|
||
</p>
|
||
<p class="desc">
|
||
Coincidentally, HTML safe is not safe from HTML Injection or "XSS" attacks. The name is deceiving. Some folks believe the raw() helper to be different than the html_safe String method. raw() is actually a wrapper for html_safe and essentially ensures exceptions are handled when the expected value is nil.
|
||
<pre class="ruby">
|
||
# Psuedo-code to help conceptualize
|
||
def raw(dirty_string)
|
||
dirty_string.to_s.html_safe
|
||
end
|
||
</pre>
|
||
|
||
</p>
|
||
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div class="accordion-group">
|
||
<div class="accordion-heading">
|
||
<a href="#collapseThree" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
|
||
<i class="icon-lightning icon-white">
|
||
</i>
|
||
Solution
|
||
</a>
|
||
</div>
|
||
<div class="accordion-body collapse" id="collapseThree" style="height: 0px;">
|
||
<div class="accordion-inner">
|
||
<p><b> Stored Cross-Site Scripting ATTACK:</b></p>
|
||
|
||
<p> When registering, enter your JavaScript tag such as <%= %{<script>alert("ohai")</script>} %> in the First Name field. Upon login the header navigation bar will echo "Welcome" + your JS code. You can have your XSS code point the victim to a <b><%= link_to "BeEF server", "http://beefproject.com", {:style => "color: rgb(69, 126, 136)" } %></b> and have some fun as well.
|
||
</p>
|
||
<p><b> Stored Cross-Site Scripting SOLUTION:</b></p>
|
||
<p>
|
||
Often developers error on the side of using "html_safe" versus "raw" with the idea being one is safer than the other. In this example, simply removing the .html_safe call would both eliminate the attack (by default, Rails 3.x html encodes these dangerous chars). Rails 2.x would require that any potentially malicious content is wrapped within an h() tag. Potentially malicious content should be thought of anything that is dynamically generated. Also, it is important to note that if for some reason you wanted to render HTML code in literal form, you can use things like sanitize() or strip_tags().
|
||
</p>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div class="accordion-group">
|
||
<div class="accordion-heading">
|
||
<a style="background-color: rgb(181, 121, 158)" href="#collapseFour" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
|
||
<i class="icon-aid icon-white">
|
||
</i>
|
||
Hint
|
||
</a>
|
||
</div>
|
||
<div class="accordion-body collapse" id="collapseFour" style="height: 0px;">
|
||
<div class="accordion-inner">
|
||
<p class="desc">
|
||
Apparently we had some issues rendering people's names with weird formatting or something, I dunno, I think I fixed it by safely encoding html and rendering the necessary content.<br/><br/>
|
||
You're <b>Welcome</b>!
|
||
</p>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div> |