Xss - Cross-Site Scripting.pdf

(1241 KB) Pobierz
Xss: Cross-site Scripting
Andrea Picardi
Alexandru Florin Lazar
Antonio Lagrotteria
Lars Dahl Jørgensen
Intro: What is XSS ?
Cross-site scripting is a type of computer
security vulnerability.
Typically found in Web-base Applications.
Code injection by malicious web users.
Examples: HTML or JavaScript code.
In 2007, 80% of all web page are vulnerable.
Intro: When is there a XSS
vulnerability?
Xss holes: when
developers have a blind
trust in the users.
It allows malicious users
to by-pass access
controls.
How can we understand if
there is a XSS hole?
Agenda
Short JavaScript Introdution (just for XSS).
Different kind of XSS attack:
Non-Persistent Attack;
Persistent Attack;
DOM Based Attack;
What can we do with XSS:
Phishing
Cookies Stealing
Real XSS cases:
Google Apps;
MySpace XSS Warm;
Method to avoid XSS.
Exercise hour: Practice with WebGoat!
JavaScript Introduction
JavaScript
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>simple page</title>
</head>
<body>
<script type="text/javascript">
document.write('Hello World!');
</script>
<noscript>
<p>Your browser either does not support JavaScript, or you
have JavaScript turned off.</p>
</noscript>
</body>
</html>

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin