Improving Web Application Security: Threats and - CGISecurity

608 Part V: Assessing Your SecurityNote Ildasm.exe is located in the \Program Files\Microsoft Visual Studio .NET 2003\SDK\v1.1\bin folder. For more information about the supported command-line arguments, run ildasm.exe /?.Cross-Site Scripting (XSS)Your code is vulnerable to cross-site scripting (XSS, also referred to as CSS) attackswherever it uses input parameters in the output HTML stream returned to the client.Even before you conduct a code review, you can run a simple test to check if yourapplication is vulnerable to XSS. Search for pages where user input information issent back to the browser.XSS bugs are an example of maintaining too much trust in data entered by a user.For example, your application might expect the user to enter a price, but instead theattacker includes a price and some HTML and JavaScript. Therefore, you shouldalways ensure that data that comes from untrusted sources is validated. Whenreviewing code, always ask the question, “Is this data validated?” Keep a list of allentry points into your ASP.NET application, such as HTTP headers, query strings,form data, and so on, and make sure that all input is checked for validity at somepoint. Do not test for incorrect input values because that approach assumes that youare aware of all potentially risky input. The most common way to check that data isvalid in ASP.NET applications is to use regular expressions.You can perform a simple test by typing text such as “XYZ” in form fields and testingthe output. If the browser displays “XYZ” or if you see “XYZ” when you view thesource of the HTML, then your Web application is vulnerable to XSS. If you want tosee something more dynamic, inject alert(‘hello’);. This techniquemight not work in all cases because it depends on how the input is used to generatethe output.The following process helps you to identify common XSS vulnerabilities:●●●●●●●●●Identify code that outputs input.Identify potentially dangerous HTML tags and attributes.Identify code that handles URLs.Check that output is encoded.Check for correct character encoding.Check the validateRequest attribute.Check the HttpOnly cookie option.Check the security attribute.Check the use of the innerText and innerHTML properties.