Web security Issues (ii): XSS attacks

Having said the CSRF attack above, this article continues to study its sibling XSS attack.

What is XSS attack
The principle of XSS attack
Methods of XSS attack
The means of XSS attack defense

What is XSS attack

XSS attack full Name (cross-site-script) cross-domain scripting attacks, in order to differentiate from CSS (cascading-style-sheet), the abbreviation is XSS.

The principle of XSS attack

The CSRF attack in the previous section exploits the "pseudo-request", which is the principle of XSS in this section using script injection.
The main is to rely on all possible means, the browser can execute script (JavaScript) into the page code, so as to obtain user cookies and even account password sensitive data caused a certain loss to users.
Usually take advantage of the target site posting, publishing products, such as the need for user input, confuse the script into the HTML input, upload to the server, and then induce other users to open this page, execute a script process.

Methods of XSS attack

The XSS vulnerability is an attack on a Web client (browser), so the implanted code is basically based on JavaScript and HTML tags (sometimes with a CSS-style XSS vector).
There are generally four ways to do this:

1. Page label comes with script
2. Dom property comes with script
3. Request address comes with script
4. Enter blank break filter limit

Give two little plums:

<script>alert(‘xss‘)</script><a href=javascrip:alert(‘xss‘)>s</a><iframe src=javascript:alert(‘xss‘);height=0 width=0 />

The means of XSS attack defense

Because the root of XSS is a means of inserting script code into a Web site and making it run. Defense methods are divided into two types, service-side defense and client defense.
Service-Side defenses:
1. HttpOnly
You can restrict JavaScript from reading cookies to prevent session ID leaks
2. Working with Rich Text
Filter out sensitive tags in rich text like (script, IFrame, form), and sensitive words (javascript:), etc.
Client Defense:
1. Input check
Prevent input of sensitive fields such as, javascript、cookie etc.
2. Check the output
Scripts are executed by confusing them in HTML and being part of the HTML code.
It is possible to escape by encoding so that the script that is confused in it is treated as text and will not be executed.
There are three ways to escape encoding:
1. HTML encode
Converts a character to a htmlentities, which typically turns 6 characters (&, <, >, ",",/). Typically used when HTML tag attributes are output
2. Javascriptencode
Use "to escape special characters.
Typically in script label output, event output, CSS output
3. URL Encode
Use the UrlEncode method.

Reference:
Analysis and anatomy of the principle of XSS
Cross-site scripting attacks (XSS)--the principle and defense of common website attack methods
XSS attacks and defenses
Workarounds for XSS attacks

Web security Issues (ii): XSS attacks