What is cross-site scripting? See there's a lot of different attacks out there
that happen with web-facing pages that get confused for cross-site scripting because
it's not necessarily a man-in-the-middle attack. It's definitely an attack against
the actual web server and the inability to validate input in some cases. Now we'll be
walking through some examples but I want to kind of flesh out what exactly is cross-site
scripting and go through the two general types of XSS attacks. So when we talk about
cross-site scripting what we generally mean is that a website has been compromised in
some way to be able to bring code from either another site or generally from a different
location ran on the original site itself. Like against input forms or something along
those lines and the input validation vulnerability means that a hacker can go in and basically
attack against those web forms and put in strings of code in the actual request itself.
We'll be doing some examples of that inside of our lab environment and there's different
and more creative ways to be able to do this but I just wanted to point out generally there
are two different types of cross-site scripting attacks and the first one that we have is a
reflected attack. Now these are generally referred to as non-persistent cross-site scripting attacks
because the effects of what they're doing don't generally stay on the actual web server itself.
So when the attack is done poof vanish it goes away and there's nothing stored on the actual
site directly. Now that's not counting things like web request logs and things like that and
cookies that form from the actual visitation of a website itself. What we're talking about in the
non-persistent category is that whatever files that are created in the course of this cross-site
scripting attack won't be directly on the actual system of the web server or the actual clients
themselves versus us going to a stored cross-site scripting attack which is generally referred to
as persistent because this will include actual files and code being ran on the system to create
more of a footprint of things to come for other web users that access that website and what I
mean is let's say we the hacker in this particular case go to a website and create a cross-site
scripting attack that is persistent and stored on that server. We've replaced some of the files and
have a method of us being able to use that web platform to be able to execute code from either
a different site or different coding platforms for the user to come in and in it unbeknownst to them
attack that website or use that website and have their data sent to us and in this case there are
actual files and code that are stored either on the web server or the client's system cells. Now
generally cross-site scripting attacks are formed and executed to be able to get
certain pieces of information and create the ability for the attacker that's doing this
to be able to use that information in malicious ways as an example in some of the things that
we'll see coming up in our labs that we have attackers using cross-site scripting attacks to
be able to sniff out credentials and be able to capture cookies other bits of information
that they can store themselves or actually recreate the actual link to send you somewhere
else that you think is legitimate on that first original site. Now there are many different ways
to do this I'm only going to be able to scratch the surface inside of this skill for us and I
want you to think of this as more along the lines of like somebody walking up to a suggestion box
and slipping a note in it and then in once we open up the box to read all the suggestions
there's one bad one in there that gets read to everybody and they take it as a fact as far as
what's actually happening with the organization. Normally those suggestions would be sift through
and see if they are legitimate or somebody's just generally complaining and for all you DOD folks
we're talking about things like a sensing session and command climate surveys that are supposed to
be anonymous right. Well in this particular case as you'll see through the examples that through
the use of persistent and non-persistent cross-site scripting attacks we can gather a lot of information
that plays into a lot of the different skills that we have already set up and executed throughout
this course. So let's do it to it!