×
iFour Logo

How to avoid Cross-Site Scripting (XSS) vulnerability in web development

iFour Team - November 07, 2017

Listening is fun too.

Straighten your back and cherish with coffee - PLAY !

Sustainable

Cross-site scripting is ranked 3rd in the list of OWASP top 10 vulnerabilities 2017. Cross-site scripting are one of the most rampant occurring injection attacks faced by various web application across businesses. That’s why to know the causes of XSS, its impact and prevention is must.

 

What is Cross-site Scripting?

Cross-site scripting attacks are types of injection, in which malicious scripts are injected into trusted web applications. This attack happens when a hacker uses web application to send infected code, many times in the form of a browser side script to the remote end user. Flaws which allow these attacks to succeed are widespread and can occur anywhere. A website uses input from a user and within an output it generates without encoding or validating it.

An attacker uses XSS to send a malicious script to victim. The end user’s browser doesn’t have any way to know the trustworthiness of the script. The user believes that the script has come from trusted source so he executes it. The malicious script in it gets all the sensitive information retained by browser like session id, tokens, cookies, etc. These kinds of scripts even rewrite the content of HTML page.

Types of XSS

Cross-site scripting has three types.

Reflected XSS: An attacker sends a link to a target application through some social media or email. This link contains an embedded script which are executed while visiting script.

Stored XSS: An attacker is able to plant a persistent script into target website which executes when anyone visits it.

Findings

Here are some findings on testing XSS on a testing web application.

We are adding one JavaScript on the search field of the web application. By doing so we will get this result.

The updated JavaScript shows the content which is updated by malicious script.

Severity: Medium

Prevention

  • To prevent your web application from XSS, you need to separate untrusted data from active browser content.
  • It is preferred to properly escape all untrusted content based on HTML context (attribute, body, CSS, JavaScript or URL) which the data would be placed into. For details see the prevention cheat sheet
  • Positive or whitelist input validation is recommended as it helps protecting against XSS, but it cannot be said as complete defence as many web applications require special characters in their input. Such kind of validation should, validate the length, format, characters, and business rules on that data before accepting input.
  • For rich content, refer auto-sanitization libraries for example OWASP’s AntiSamy.
  • Refer Content Security Policy (CSP) to protect against XSS for your web application.

Planning to Hire Desktop App Development Company? Your Search ends here.

Conclusion

In today’s world where every industry moving towards digitization, attackers also are keeping owl eyes breaking them in easiest way. A website for a company is the first image for customers. So, it has become mandatory for web developers to take precautions for various web application attacks and making it secured from attackers.

How to avoid Cross-Site Scripting (XSS) vulnerability in web development Cross-site scripting is ranked 3rd in the list of OWASP top 10 vulnerabilities 2017. Cross-site scripting are one of the most rampant occurring injection attacks faced by various web application across businesses. That’s why to know the causes of XSS, its impact and prevention is must.   Table of Content 1. What is Cross-site Scripting? 2. Types of XSS 3. Findings 4. Prevention 5. Conclusion What is Cross-site Scripting? Cross-site scripting attacks are types of injection, in which malicious scripts are injected into trusted web applications. This attack happens when a hacker uses web application to send infected code, many times in the form of a browser side script to the remote end user. Flaws which allow these attacks to succeed are widespread and can occur anywhere. A website uses input from a user and within an output it generates without encoding or validating it. An attacker uses XSS to send a malicious script to victim. The end user’s browser doesn’t have any way to know the trustworthiness of the script. The user believes that the script has come from trusted source so he executes it. The malicious script in it gets all the sensitive information retained by browser like session id, tokens, cookies, etc. These kinds of scripts even rewrite the content of HTML page. Read More: Secure Web Application From insecure Direct Object References Types of XSS Cross-site scripting has three types. Reflected XSS: An attacker sends a link to a target application through some social media or email. This link contains an embedded script which are executed while visiting script. Stored XSS: An attacker is able to plant a persistent script into target website which executes when anyone visits it. Findings Here are some findings on testing XSS on a testing web application. We are adding one JavaScript on the search field of the web application. By doing so we will get this result. The updated JavaScript shows the content which is updated by malicious script. Severity: Medium Prevention To prevent your web application from XSS, you need to separate untrusted data from active browser content. It is preferred to properly escape all untrusted content based on HTML context (attribute, body, CSS, JavaScript or URL) which the data would be placed into. For details see the prevention cheat sheet Positive or whitelist input validation is recommended as it helps protecting against XSS, but it cannot be said as complete defence as many web applications require special characters in their input. Such kind of validation should, validate the length, format, characters, and business rules on that data before accepting input. For rich content, refer auto-sanitization libraries for example OWASP’s AntiSamy. Refer Content Security Policy (CSP) to protect against XSS for your web application. Planning to Hire Desktop App Development Company? Your Search ends here. See here Conclusion In today’s world where every industry moving towards digitization, attackers also are keeping owl eyes breaking them in easiest way. A website for a company is the first image for customers. So, it has become mandatory for web developers to take precautions for various web application attacks and making it secured from attackers.

Categories

Ensure your sustainable growth with our team

Talk to our experts
Sustainable
Sustainable
 

Blog Our insights

A comprehensive guide on how to hire Frontend developers in 2022
A comprehensive guide on how to hire Frontend developers in 2022

Table of Content 1.What frontend stack to choose for your project? 2.Where to find the right frontend developers? 3.Hiring frontend developers: a step-by-step guide 4.Technical...

Read More
Why construction software is essential for your construction business?
Why construction software is essential for your construction business?

Table of Content 1. Increased profits with reduced risks 2. Powerful integration with accounting software 3. Streamlines key operations with the power of automation 4....

Read More
Why do .NET developers choose Angular over React?
Why do .NET developers choose Angular over React?

Table of Content 1. Angular offers several built-in libraries similar to .NET 2. Angular's syntax is much closer to C# 3. Angular uses TypeScript, a strongly-typed...

Read More