XSS Lightning talk
0 likes759 views
This document summarizes a lightning talk on cross-site scripting (XSS) attacks. It defines XSS as the injection of malicious JavaScript onto a website with the intent of client-side execution. There are three main types of XSS attacks: reflected, persistent, and DOM-based. The talk focuses on persistent XSS attacks. It provides examples of how XSS could be used to scan local networks, steal user sessions through cookie theft, and gain complete control of the vulnerable webpage. The document concludes by recommending tools and resources for learning more about conducting white hat XSS testing.
XSS Lightning talk
- 1. March 2012 Introduction to Cross Site Scripting Lightning talk held at OSAA Johnny Vestergaard <jkv@unixcluster.dk> http://dk.linkedin.com/in/johnnykv
- 2. XSS - Cross Site Scripting Worst name ever?? ● Think of it as "JavaScript Injection". ○ (and ignore the haters) ● Injection of malicious JavaScript on a site with the intend of client side execution. ● Three types: Reflected, Persistent and DOM based. ● We will focus on Persistent XSS tonight.
- 3. Safe website
- 5. Hey - it's just client side!
- 6. Having a client side party ● Possibilities ○ Host scanning of client-side LAN ○ Session takeover (cookie stealing) ○ Eavesdropping ■ Keylogging ■ Events ○ Complete control of the page ● Limitations ○ Confined to the browser
- 7. Demo ● Keylogger using metasploit ● Cookie stealer with python backend
- 8. Demo #1 - Keylogger with metasploit
- 9. Demo #2 - The Cookie Monster https://gist.github.com/1968842
- 10. Do it yourself Whitehat style ● Backtrack 5 ○ http://www.backtrack-linux.org/ ● OWASP Broken Web Applications Project ○ VMware image with broken web apps ○ http://bit.ly/yNsF9K ● Cookie Monster ○ http://gist.github.com/1968842 ● Slides ○ http://www.slideshare.net/JohnnyKV/