the-web-application-hackers-handbook

CHAPTER
12
Attacking Users:
Cross-Site Scripting
All the attacks we have considered so far involve directly targeting the serverside
application. Many of these attacks do, of course, impinge upon other users,
such as a SQL injection attack that steals other users’ data. But the attacker’s
essential methodology was to interact with the server in unexpected ways to
perform unauthorized actions and access unauthorized data.
The attacks described in this chapter and the next are in a different category,
because the attacker’s primary target is the application’s other users. All the
relevant vulnerabilities still exist within the application itself. However, the
attacker leverages some aspect of the application’s behavior to carry out malicious
actions against another end user. These actions may result in some of the same
effects that we have already examined, such as session hijacking, unauthorized
actions, and the disclosure of personal data. They may also result in other
undesirable outcomes, such as logging of keystrokes or execution of arbitrary
commands on users’ computers.
Other areas of software security have witnessed a gradual shift in focus from
server-side to client-side attacks in recent years. For example, Microsoft used
to frequently announce serious security vulnerabilities within its server products.
Although numerous client-side flaws were also disclosed, these received
much less attention because servers presented a much more appealing target
for most attackers. In the course of just a few years, at the start of the twentyfirst
century, this situation has changed markedly. At the time of this writing,
431