Skip to content

Commit 3654f74

Browse files
zachroofseczachroofsec
committed
Updating for DOM XSS Episode
1 parent e886926 commit 3654f74

1 file changed

Lines changed: 133 additions & 0 deletions

File tree

‎ep6-dom-xss/readme.org‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
#+TITLE: DOM XSS
2+
* Ep-5: What is DOM XSS
3+
** Table Of Contents
4+
- [[#ep-5-what-is-dom-xss][Ep-5: What is DOM XSS]]
5+
- [[#scope][Scope]]
6+
- [[#xss-types][XSS Types]]
7+
- [[#traditional-approaches-to-input-validation][Traditional Approaches To Input Validation]]
8+
- [[#assignment-1-exploiting-dom-xss-scenario][Assignment 1: Exploiting DOM XSS (Scenario)]]
9+
- [[#assignment-1-exploiting-dom-xss][Assignment 1: Exploiting DOM XSS]]
10+
- [[#assignment-1-exploiting-dom-xss-hints][Assignment 1: Exploiting DOM XSS (Hints)]]
11+
- [[#assignment-1-exploiting-dom-xss-answer][Assignment 1: Exploiting DOM XSS (Answer)]]
12+
- [[#assignment-1-exploiting-dom-xss-answer-exploration][Assignment 1: Exploiting DOM XSS (Answer Exploration)]]
13+
- [[#assignment-1-exploiting-dom-xss-answer-exploration-cont][Assignment 1: Exploiting DOM XSS (Answer Exploration) CONT]]
14+
- [[#persistentreflected-xss-vs-dom-xss][Persistent/Reflected XSS vs DOM XSS]]
15+
- [[#persistentreflected-xss-vs-dom-xss-cont][Persistent/Reflected XSS vs DOM XSS (CONT)]]
16+
- [[#knowledge-dependency-tree][Knowledge Dependency Tree]]
17+
- [[https://securing-the-stack.teachable.com/p/reflected-cross-site-scripting][Reflected XSS]]
18+
- [[https://securing-the-stack.teachable.com/p/persistent-cross-site-scripting][Persistent XSS]]
19+
20+
** Scope
21+
- What is DOM XSS (Cross-Site Scripting)?
22+
- How is DOM XSS different from Reflected/Persistent XSS?
23+
- Live Assignment: Exploit DOM XSS within OWASP's Juice Shop!
24+
- Why is DOM XSS so difficult to detect?
25+
** XSS Types
26+
- Persistent
27+
- Stored XSS
28+
- Non-Persistent
29+
- Reflected XSS
30+
- DOM XSS
31+
- Type 0 XSS
32+
** Traditional Approaches To Input Validation
33+
- Building up to ~XSS Mitigations~ module
34+
- Server-side Validation
35+
- Reject user input if it contains unexpected characters/strings
36+
- Result: Response to browser doesn't contain XSS
37+
- Client-side Validation
38+
- Validate user input before sending to the server
39+
- Ex: Check form fields for unexpected input before sending information
40+
to the server
41+
- Only deters the most novice "hackers"
42+
- Is this the only client-side validation that should occur?
43+
- Of course not... :)
44+
45+
** Assignment 1: Exploiting DOM XSS (Scenario)
46+
- OWASP Juice Shop
47+
- Intentionally vulnerable web app
48+
- https://github.com/securingthestack/juice-shop
49+
- ~dom-xss-1~ branch
50+
- ~docker run --rm -p 3000:3000 securingthestack/juice-shop:dom-xss-1~
51+
- Navigate browser to ~http://localhost:3000~
52+
53+
** Assignment 1: Exploiting DOM XSS
54+
- Assignment Assumptions
55+
1. The application vigoriously monitors server logs for XSS and patches immediately
56+
- Result: Assume server-side validation of XSS is correctly occurring
57+
- No Reflected XSS in server response
58+
2. No form of client-side validation is occurring
59+
- "Client-side validation is useless because we validate on the server"
60+
3. The browser has loaded all front-end code
61+
- Find an XSS flaw within ~http://localhost:3000~ without submitting a request
62+
to the server
63+
- Hints on next slide if you're stuck
64+
65+
** Assignment 1: Exploiting DOM XSS (Hints)
66+
- Where do many front-end frameworks store client-side state?
67+
- If ~x~ character is in the url, ~xFOO~ doesn't invoke a request to the server
68+
- Look in ~localhost:3000/dist/juice-shop.min.js~ for ~trustAsHtml~
69+
- Google Chrome Ex for Pretty Printing
70+
- How can malicious input come into the client?
71+
- Reflected XSS Module Ex.
72+
73+
** Assignment 1: Exploiting DOM XSS (Answer)
74+
- ~<script>alert("Evil Code Is Running")</script>~ within Search field
75+
- Url inspection
76+
- ~q~ is after ~#~ so the browser won't initiate a request
77+
- Imagine payload spreading via a malicious link
78+
79+
** Assignment 1: Exploiting DOM XSS (Answer Exploration)
80+
- Strict Contextual Escaping (SCE)
81+
- Is a mode in which AngularJS constrains bindings to only render trusted values
82+
- Javascript Source
83+
#+BEGIN_SRC javascript
84+
$scope.searchQuery = $sce.trustAsHtml($location.search().q)
85+
#+END_SRC
86+
- juice-shop.min.js
87+
#+BEGIN_SRC javascript
88+
r.searchQuery = e.trustAsHtml(n.search().q);
89+
#+END_SRC
90+
- HTML
91+
- ~$sce.trustAsHtml~ will pass unsanitisized input to ~ng-bind-html~
92+
#+BEGIN_SRC html
93+
<h3 ng-show="searchQuery">
94+
<span translate="TITLE_SEARCH_RESULTS"></span>
95+
<span ng-bind-html="searchQuery"></span>
96+
</h3>
97+
#+END_SRC
98+
** Assignment 1: Exploiting DOM XSS (Answer Exploration) CONT
99+
- juice-shop.min.js
100+
#+BEGIN_SRC javascript
101+
angular.module("juiceShop").config(["$sceProvider", function(e) {
102+
e.enabled(!1)
103+
}])
104+
#+END_SRC
105+
** Persistent/Reflected XSS vs DOM XSS
106+
- Propigation
107+
- Persistent/Reflected XSS
108+
- XSS payload is embedded in server's response to the client
109+
- DOM XSS
110+
- XSS payload stays within the browser
111+
- Mitigations
112+
- Persistent/Reflected XSS
113+
- Can be mitigated by server-side/client-side input validation
114+
- Client-side validation
115+
- Native Angular functionality
116+
- Don't want to rely on this
117+
- DOM XSS
118+
- Client-side validation
119+
120+
** Persistent/Reflected XSS vs DOM XSS (CONT)
121+
- Detectability
122+
- Persistent/Reflected XSS
123+
- Relatively easy to detect due to server logging
124+
- DOM XSS
125+
- No detectability
126+
- Done :D
127+
128+
** Additional Resources
129+
:PROPERTIES:
130+
:CUSTOM_ID: h-758E5075-EB7E-4F7E-832D-F74618B2E718
131+
:END:
132+
** Error Log
133+
** Knowledge Dependency Tree

0 commit comments

Comments
 (0)