the-web-application-hackers-handbook

Chapter 12 n Attacking Users: Cross-Site Scripting 491
n If an application receives data via some out-of-band channel and renders
this within its web interface, any stored XSS bugs can be exploited without
submitting any malicious payload using HTTP.
n Attacks against DOM-based XSS may not involve submitting any malicious
payload to the server. If the fragment technique is used, the payload
remains on the client at all times.
Some applications employ a more sophisticated client-side script that performs
stricter parsing of the query string. For example, it may search the URL for the
parameter name followed by the equals sign but then extract what follows only
until it reaches a relevant delimiter such as & or #. In this case, the two attacks
described previously could be modified as follows:
http://mdsec.net/error/79/Error.ashx?foomessage=alert(1)&message=Sorry%2c+an+error+occurred
http://mdsec.net/error/79/Error.ashx#message=alert(1)
In both cases, the first match for message= is followed immediately by the
attack string, without any intervening delimiter, so the payload is processed
and copied into the HTML page source.
TRY IT!
http://mdsec.net/error/79/
In some cases, you may find that complex processing is performed on DOMbased
data. Therefore, it is difficult to trace all the different paths taken by usercontrollable
data, and all the manipulation being performed, solely through static
review of the JavaScript source code. In this situation, it can be beneficial to use
a JavaScript debugger to monitor the script’s execution dynamically. The FireBug
extension to the Firefox browser is a full-fledged debugger for client-side code
and content. It enables you to set breakpoints and watches on interesting code
and data, making the task of understanding a complex script considerably easier.
COMMON MYTH
“We’re safe. Our web application scanner didn’t find any XSS bugs.”
As you will see in Chapter 19, some web application scanners do a reasonable
job of finding common flaws, including XSS. However, it should be
evident at this point that many XSS vulnerabilities are subtle to detect, and
creating a working exploit can require extensive probing and experimentation.
At the present time, no automated tools can reliably identify all these bugs.