Cross Site Scripting
Last updated
Was this helpful?
Last updated
Was this helpful?
It is possible to store and execute malicious scripts into the application. This vulnerability presents a high risk to the business since it lets an attacker to steal the valid session credentials of an authenticated user in the application.
Reflected XSS
Stored XSS
DOM Based XSS
When given the malicious script inside the input field and click update to store the given information
Here we given the malicious script as a payload to get the cookie information as <script>alert(document.cookie)</script>
Given malicious script is stored permanently and cookie shown in this application like the below screenshot.
When the attack is injected into the application during runtime in the client directly.
When a browser is rendering HTML and any other associated content like CSS, JavaScript, etc. it identifies various rendering contexts for the different kinds of input and follows different rules for each context. A rendering context is associated with the parsing of HTML tags and their attributes.
The application must implement server side validation for all user-entered inputs.
HTML tags should be rejected by HTML encoding process.
The HTML entities function in PHP is used to convert characters into corresponding HTML entities where applicable. It is used to encode user input on a website so that users cannot insert harmful HTML codes into a site.
To prevent the Stored XSS we have to use the htmlentities() when storing the data to the server
This htmlentities() function will encode the user input and stores the data like below
When we fetch the stored data it will be shown as what we have stored in the database like the above instead of executing the malicious scripts.
In ASP.NET Server.HtmlEncode() function will encode the user input and stores the data.
when we fetch the stored data it will be shown as what we have stored in the database instead of executing the malicious scripts.
First we have to import the library “org.apache.commons.lang3.StringEscapeUtils;”
In JSP StringEscapeUtils.escapeHtml4() function will encode the user input and stores the data and when we fetch the stored data it will be shown as what we have stored in the database instead of executing the malicious scripts.
HTML encoding, and then
JavaScript encoding all untrusted input, as shown in these examples:
Note: The Encoder.encodeForHTML() and Encoder.encodeForJS() are just notional encoders. Various options for actual encoders are listed later in this link
