the-web-application-hackers-handbook

Chapter 12 n Attacking Users: Cross-Site Scripting 449
website may contain an HTML form that uses the POST method and that
has the vulnerable application as its target URL. JavaScript or navigational
controls on the page can be used to submit the form, successfully exploiting
the vulnerability.
n In a variation on the third-party website attack, some attackers have been
known to pay for banner advertisements that link to a URL containing
an XSS payload for a vulnerable application. If a user is logged in to the
vulnerable application and clicks the ad, her session with that application
is compromised. Because many providers use keywords to assign
advertisements to pages that are related to them, cases have even arisen
where an ad attacking a particular application is assigned to the pages of
that application itself! This not only lends credibility to the attack but also
guarantees that someone who clicks the ad is using the vulnerable application
at the moment the attack strikes. Furthermore, since the targeted
URL is now “on-site,” the attack can bypass browser-based mechanisms
employed to defend against XSS (described in detail later in this chapter).
Because many banner ad providers charge on a per-click basis, this
technique effectively enables an attacker to “buy” a specific number of
user sessions.
n Many web applications implement a function to “tell a friend” or send
feedback to site administrators. This function often enables a user to
generate an e-mail with arbitrary content and recipients. An attacker
may be able to leverage this functionality to deliver an XSS attack via an
e-mail that actually originates from the organization’s own server. This
increases the likelihood that even technically knowledgeable users and
anti-malware software will accept it.
Delivering Stored XSS Attacks
The two kinds of delivery mechanisms for stored XSS attacks are in-band and
out-of-band.
In-band delivery applies in most cases and is used when the data that is
the subject of the vulnerability is supplied to the application via its main web
interface. Common locations where user-controllable data may eventually be
displayed to other users include the following:
n Personal information fields — name, address, e-mail, telephone, and the like
n Names of documents, uploaded files, and other items
n Feedback or questions for application administrators
n Messages, status updates, comments, questions, and the like for other
application users