the-web-application-hackers-handbook

498 Chapter 12 n Attacking Users: Cross-Site Scripting
}
var d = document.createElement(‘div’);
d.appendChild(document.createTextNode(str));
return d.innerHTML;
Summary
This chapter has examined the various ways in which XSS vulnerabilities can
arise and ways in which common filter-based defenses can be circumvented.
Because XSS vulnerabilities are so prevalent, it is often straightforward to find
several bugs within an application that are easy to exploit. XSS becomes more
interesting, from a research perspective at least, when various defenses are in
place that force you to devise some highly crafted input, or leverage some littleknown
feature of HTML, JavaScript, or VBScript, to deliver a working exploit.
The next chapter builds on this foundation and examines a wide variety of
further ways in which defects in the server-side web application may leave its
users exposed to malicious attacks.
Questions
Answers can be found at http://mdsec.net/wahh.
1. What standard “signature” in an application’s behavior can be used to
identify most instances of XSS vulnerabilities?
2. You discover a reflected XSS vulnerability within the unauthenticated
area of an application’s functionality. State two different ways in which
the vulnerability could be used to compromise an authenticated session
within the application.
3. You discover that the contents of a cookie parameter are copied without
any filters or sanitization into the application’s response. Can this behavior
be used to inject arbitrary JavaScript into the returned page? Can it be
exploited to perform an XSS attack against another user?
4. You discover stored XSS behavior within data that is only ever displayed
back to yourself. Does this behavior have any security significance?
5. You are attacking a web mail application that handles file attachments
and displays these in-browser. What common vulnerability should you
immediately check for?
6. How does the same-origin policy impinge upon the use of the Ajax technology
XMLHttpRequest?