Cross-Site Scripting (XSS) Explained

Cross-Site Scripting (XSS)

• XSS is a web security vulnerability where attackers inject malicious scripts, often JavaScript, into a website.
• These scripts execute in the victim's browser when they load the affected webpage.
• Outcomes of successful XSS attacks include: session hijacking, data theft, phishing, or malware injection.

How XSS Works

• An attacker injects a malicious script into a webpage through a search bar, comment box, or URL.
• The website fails to sanitize the input, incorporating the script into the page.
• When another user visits the page, their browser executes the injected script.
• Consequentially, the attacker can steal sensitive data, modify page content, or redirect the victim.

Types of XSS Attacks

Reflected XSS (Immediate Execution)

• The malicious script is injected via a URL or form input
• Scripts are not stored permanently on the server
• Execution occurs only when the victim clicks a malicious link.
• Attackers can use phishing emails to trick users into clicking malicious links.

Stored XSS (Persistent, More Dangerous)

• In stored XSS, the malicious script is saved in the website's database.
• The script loads whenever users view the compromised page.
• Comment sections, forums, and profile fields are common targets.
• Every visitor to the infected page is at risk without clicking any links.

DOM-Based XSS (Client-Side Vulnerability)

• The browser modifies the webpage's structure using JavaScript, leading to an XSS attack.
• If an attacker sends a URL like https://example.com#<script>alert('XSS')</script>, the browser executes the script without server involvement.

Proper Authentication of Subjects

• Step 1: A subject identifies themselves.
• Step 2: The subject provides assurance that their claimed identity is valid.
• Step 3: The subject presents a set of credentials.
• Step 4: The system validates the supplied credentials.
• Step 5: Access is granted upon successful validation.

Basic Authentication Methods

• Type I: Something You Know (e.g., password).
• Type II: Something You Have (e.g., a token).
• Type III: Something You Are (e.g., biometrics).
• Type IV: Somewhere You Are (e.g., geolocation).

Type I - Something You Know

• This method uses a challenge-response system.
• Access is granted if the response is correct.
• A classic example is username/password or PIN.
• It's the easiest and weakest form of authentication.

About Passwords

• There are four types of passwords to consider when implementing access controls.
• Static Passwords: User-generated, reusable passwords that may or may not expire, often combined with other authentication.
• Passphrases: Long static passwords composed of several words or a sentence. Typically don't expire.
• One-Time Passwords: Used for a single authentication instance and are secure but hard to maintain.
• Dynamic Passwords: Change at regular intervals. Combined with static passwords for added security.

Type II - Something You Have

• Requires users to possess a token to prove their identity.
• A token is a device that helps verify the user's claim to an identity.
• Dynamic Tokens are usually synchronous and asynchronous.

Type III - Something You Are

• Relies on Biometrics.
• Uses physical characteristics for identification and authentication.
• Examples: Fingerprints, Retina Scan, Iris Scan, Hand Geometry, Voiceprint.

Type IV - Someplace You Are

• This method employs geolocation or location-based access control.
• Technologies such as GPS can accept or deny access based on the current location of the subject.

Data Remanence

• Data Remanence: Data that persists even when deleted by "Non-invasive” means.
• It's often discussed in Digital Forensics and Data Destruction contexts.

Data Remanence in Disk Drives

Hard Disks

• Data is recorded magnetically on platters.
• Mechanical read/write heads move, and the platter rotates.
• Magnetic data is not erased, only the indexes are.
• New data may overwrite deleted data.

Solid State Drives

• Flash memory (chips) is used to store data.
• Data Accessed directly (no mechanically moving parts)
• New data is typically written to a new location
• Destruction Incineration/shredding is best for chips
• Hybrid drives cannot be cleared by degaussing.

Data Remanence Countermeasures

• Overwriting: Writing zeros, ones, or random data on all sectors; not efficient on SSDs or USB drives.
• Degaussing: Using special equipment to remove or reduce magnetic fields; limited to magnetic drives, may render media inoperable.
• Encryption: Encrypting data before storing in cloud servers, saving keys locally; difficult key management, encrypted data cannot be processed in the cloud.
• Destruction: Physical or chemical destruction techniques; not applicable in a cloud environment.

Memory

• Fundamentally a series of 'on' and 'off' switches used to represent the binary digits (0 and 1)
• Volatile Memory loses data when power is turned off
• Data is stored temporarily
• It is faster than non-volatile memory
• The storage capacity is less when compared to non-volatile memory
• Data can be easily trasnferred
• Examples are RAM and Cache Memory

Real (Primary) Memory

• RAM is a Real or ‘Primary' memory
• Directly accessible by the CPU
• Holds instructions and data for currently executing processes
• 'Scratch Pad' Memory

Cache Memory

• Static random-access memory (SRAM) is used for cache memory.
• The next fastest form of cache memory is Level 1 cache, located on the CPU itself.
• Level 2 cache is connected to (but outside of) the CPU.
• Keeps up with the CPU as it fetches and executes instructions
• Fastest system memory
• Data most frequently used by CPU is stored here

RAM vs ROM

• RAM (Random Access Memory): Volatile, can be directly accessed by the CPU, used to store temporary information, larger in size, fast data write speeds
• ROM (Read Only Memory): Non-Volatile, cannot be directly accessed by the CPU, stores permanent information, smaller in size, slow write process

DRAM vs SRAM

• SRAM: Lower access time, costlier, requires constant power supply, lower storage capacity, has low packaging density.
• DRAM: Higher access time, less expensive, reduced power consumption, large storage capacity, has high packaging density.

SSD (Solid State Devices)

• SSD consist of Flash Memory (EEPROM) and DRAM.
• Data is mapped logically
• Writes on unused portions and marks previous ones as unallocated

SSD vs HDD

• SSD: Faster, shorter lifespan, more expensive, non-mechanical, shock-resistant, best for storing OS and gaming
• HDD: Slower, longer lifespan, cheaper, mechanical, fragile, best for storing extra data (movies, photos, docs)

Access Control Vulnerability

• Occurs when a web application improperly restricts user access to resources or functions
• Attackers exploit these weaknesses to access unauthorized data, modify settings, or perform actions as other users or administrators
• Access Control Vulnerabilities Works when: A web application fails to properly enforce restrictions on user actions, An attacker manipulates requests, If the server does not validate permissions correctly, the attacker can access or modify data they shouldn't

Types of Access Control Vulnerabilities

• Broken Object-Level Authorization (BOLA): Attackers modify object IDs in requests to access another user's data.
• Broken Function-Level Authorization: Unauthorized users gain access to restricted functionality
• Insecure Direct Object References (IDOR): Attackers directly access files, database records, by modifying request parameters
• Forced Browsing: Attackers access hidden but unprotected URLs.
• Privilege Escalation: Attackers upgrade their user permissions by modifying roles in requests.