the-web-application-hackers-handbook

Chapter 12 n Attacking Users: Cross-Site Scripting 443
had nearly one million friend requests. As a result, MySpace had to take the
application offline, remove the malicious script from the profiles of all its users,
and fix the defect in its anti-XSS filters.
For more details on this attack, see this URL:
http://namb.la/popular/tech.html
Web mail applications are inherently at risk of stored XSS attacks because
of how they render e-mail messages in-browser when viewed by the recipient.
E-mails may contain HTML-formatted content, so the application effectively
copies third-party HTML into the pages it displays to users. In 2009, a web mail
provider called StrongWebmail offered a $10,000 reward to anyone who could
break into the CEO’s e-mail. Hackers identified a stored XSS vulnerability within
the web mail application that allowed arbitrary JavaScript to be executed when
the recipient viewed a malicious e-mail. They sent a suitable e-mail to the CEO,
compromised his session on the application, and claimed the reward.
For more details on this attack, see this URL:
http://blogs.zdnet.com/security/?p=3514
In 2009, Twitter fell victim to two XSS worms that exploited stored XSS vulnerabilities
to spread between users and post updates promoting the website of the
worms’ author. Various DOM-based XSS vulnerabilities have also been identified
in Twitter, arising from its extensive use of Ajax-like code on the client side.
For more details on these vulnerabilities, see the following URLs:
www.cgisecurity.com/2009/04/two-xss-worms-slam-twitter.html
http://blog.mindedsecurity.com/2010/09/twitter-domxss-wrong-fix-andsomething.html
Payloads for XSS Attacks
So far, we have focused on the classic XSS attack payload. It involves capturing
a victim’s session token, hijacking her session, and thereby making use of the
application “as” the victim, performing arbitrary actions and potentially taking
ownership of that user’s account. In fact, numerous other attack payloads may
be delivered via any type of XSS vulnerability.
Virtual Defacement
This attack involves injecting malicious data into a page of a web application to
feed misleading information to users of the application. It may simply involve
injecting HTML markup into the site, or it may use scripts (sometimes hosted
on an external server) to inject elaborate content and navigation into the site.