|
[EN] XSS Guide - How To fix a XSS vulnerability
|
| Author |
Message |
Langy
Administrator
Posts: 8.464
Group: Administrators
Joined: Sep 2007
Status:
Offline
Reputation: 10
|
[EN] XSS Guide - How To fix a XSS vulnerability
XSS Guide - 4th Part - How To fix a XSS vulnerability
-------------------------------
Author: Langy
Data: 19-02-2008
Copyright: http://www.googlebig.com
-------------------------------
Links:
http://www.gnucitizen.org/xssdb/application.htm (Attack Database)
http://www.xssed.com (Mirror Archive of Vulnerable Websites)
http://ha.ckers.org/xss.html (XSS Cheat sheet)
http://software.graflex.org/dexss/ (Removing JavaScript from HTML)
http://en.wikipedia.org/wiki/Cross-site_scripting
http://it.php.net/htmlentities
http://it2.php.net/htmlspecialchars
http://it2.php.net/strip_tags
-------------------------------
For fix the problem of cross site injection we have to use one of the 3 functions php.
These functions clean up the HTML tags, so is not possible inject into the code.
The function more used is htmlspecialchars() that transmutes all the characters "<" and ">" into "<" and ">".
Another option is htmlentities(), which replaces all the characters in the corresponding entities.
<?
// This page shows an example
// of the differences in output between 2 functions
$input = '<script>alert(1);</script>';
echo htmlspecialchars($input) . '<br />';
echo htmlentities($input);
?>
An example of htmlentities()
<?php
$str = "A 'quote' is <b>bold</b>";
echo htmlentities($str);
echo htmlentities($str, ENT_QUOTES);
?>
The first show --> A 'quote' is <b>bold</b>
The second --> A 'quote' is <b>bold</b>
An example of htmlspecialchars()
<?php
$new = htmlspecialchars("<a href='test'>Test</a>", ENT_QUOTES);
echo $new;
?>
This show --> <a href='test'>Test</a>
The funztion strip_tags(), instead, deletes all HTML elements, except certain elements that need to specify permitted such as <i>, <b> or <p>.
An example of strip_tags()
<?php
$text = '<p>Test paragraph.</p><!-- Comment --> Other text';
echo strip_tags($text);
echo "\n";
// allow <p>
echo strip_tags($text, '<p>');
?>
Now that we know at least that there are these functions, we will to apply into the code when we find a xss in our web application.
I have recently found a xss on my website in Video section of GoogleBig which is a plugin of Mybb forum, I have placed a piece of code to make the idea of how I had to apply the function to fix the search bug.
First of all I have found the php page in question: search.php
Now let's look for the portion of code that makes available research, query and output the result of the query:
function search($query, $page)
{
global $db, $bgcolor2, $bgcolor4, $sitename, $io_db, $module_url, $list_page_items, $hm_index;
$option = trim($option);
$query = trim($query);
$query = FixQuotes(nl2br(filter_text($query)));
$db->escape_string($query);
$db->escape_string($option);
alpha_search($query);
...
In this case the variable that passes the values is $query then we apply the function htmlentities():
$query = FixQuotes(nl2br(filter_text(htmlentities($query))));
If you have problems you can post here, or consult the manuals on these 3 php functions that we saw:
http://it.php.net/htmlentities
http://it2.php.net/htmlspecialchars
http://it2.php.net/strip_tags
The following guide can be used freely on any site without changes including copyright.
Versione italiana: http://www.googlebig.com/forum/guida-xss...t-177.html
"There is no patch for human stupidity" - K. D. M.
This post was last modified: 29-02-2008 12:10 PM by Langy.
Browser e O.S.:
|
|
| 29-02-2008 11:32 AM |
|
 |
xylitol
GB - Junior Member
Posts: 14
Group: Registered
Joined: Feb 2008
Status:
Offline
Reputation: 1
|
RE: [EN] XSS Guide - How To fix a XSS vulnerability
Great tuts
securing xss is important
ïeverse
__
Xyl
Browser e O.S.:
|
|
| 29-02-2008 07:04 PM |
|
|
RedTuning
Moderator
Posts: 88
Group: Moderators
Joined: Dec 2007
Status:
Offline
Reputation: 2
|
RE: [EN] XSS Guide - How To fix a XSS vulnerability
yep, very nice tutorial langy
Molte persone sono animali mitologici....animali mitologici con corpo d'uomo e testa di cazzo
=================================
http://www.metalhammer.co.uk/gods/
Vote In Flames in Best International band in MetalHammer Golden Gods!!!
-in IN FLAMES we TRUST-
Browser e O.S.:
|
|
| 29-02-2008 08:20 PM |
|
|
Thibow
GB - Newbie
Posts: 1
Group: Registered
Joined: Aug 2009
Status:
Offline
Reputation: 0
|
RE: [EN] XSS Guide - How To fix a XSS vulnerability
Nice man :)
70% of website are vulnerable to this attack.
I use strip-tags() PHP function for secure it ... and I used trim() also.
For example:
<?php
$text = '<p>Test paragraph.</p><!-- Comment --> Other text';
echo strip_tags(trim($text));
echo "\n";
// allow <p>
echo strip_tags(trim($text), '<p>');
?>
Browser e O.S.:
|
|
| 13-08-2009 05:54 PM |
|
|
free0
GB - Junior Member
Posts: 39
Group: Registered
Joined: Apr 2010
Status:
Offline
Reputation: 0
|
RE: [EN] XSS Guide - How To fix a XSS vulnerability
thank's
attack or "xss" ...
this is great for exploit in web ... security "achtung****
Browser e O.S.:
|
|
| 16-04-2010 09:45 PM |
|
|
Liyan oz
GB - Newbie
Posts: 2
Group: Registered
Joined: Feb 2011
Status:
Offline
Reputation: 0
|
RE: [EN] XSS Guide - How To fix a XSS vulnerability
Browser e O.S.:
|
|
| 19-02-2011 11:48 AM |
|
|
abstonini
GB - Newbie
Posts: 1
Group: Registered
Joined: Jan 2013
Status:
Offline
Reputation: 0
|
RE: [EN] XSS Guide - How To fix a XSS vulnerability
Browser e O.S.:
|
|
| 17-01-2013 08:11 PM |
|
|
MaimiWemn
GB - Newbie
Posts: 2
Group: Registered
Joined: Jan 2013
Status:
Offline
Reputation: 0
|
RE: [EN] XSS Guide - How To fix a XSS vulnerability
Buy Actonel === BUY ONLINE === Buy Residronate
Click price below and you will be redirected to our pharmacy.
Tags:
low cost generic Actonel without prescription Yukon
canadian pharmacies to get Actonel Florida
what is the price of Residronate how to write a prescription for
get Actonel in usa
cheapest place to buy Actonel generic dose Charlotte
low price Residronate cheap pharmacy
cheap Actonel cheap generic from india Poland
cheapest Residronate without rx Connecticut
http://www.breakingbadaddict.com/forum/v...=12&t=5001
best price for generic Residronate cheapest price Rochester
where can i buy Actonel online no prescription Surprise
what is the price of Residronate USA
donde puedo comprar Residronate 35 mg generic does look like
best price on Residronate Allentown
no prescription Residronate Cardiff
http://iiiwant.com/discuz/viewthread.php...370&extra=
when will generic Actonel money order KY
side effects of Residronate canadian online pharmacy no prescription Pomona
cheapest price for generic Actonel online without valid prescription Hamburg
http://www.yupana.com/forum/showthread.p...=84327%22/
best price on Actonel generic prices
donde puedo comprar Residronate online canadian pharmacy
best place to buy Actonel prescription cost at target for es Erie
no prescription Actonel generic name brand Tampa
non prescription Actonel canadian for purchase
discount generic Residronate cheap no prescription
canadian pharmacies to get Actonel cheap generic best price
is there a generic for Residronate prices of prescription
discount generic Actonel online pharmacy no prescription Overland Park
low cost generic Residronate 35 mg generic uk
best pharmacy price for Residronate Sioux Falls
best price generic Actonel online with mastercard
how do you get Actonel price online Denver
ordering Residronate over the counter usa Santa Rosa
free Residronate no prescription no membership
where to buy Residronate generic supplier india
cheapest price Actonel canadian online pharmacy no prescription
overnight delivery of Residronate germany Nashville
canadian generic Residronate online orders
necesito comprar Residronate non prescription South Australia
american pharmacies for generic Residronate 35mg purchase without prescription
canada cheap Residronate 35 mg Nunavut
natural Actonel prices of prescription
online order Actonel New Haven
buy cheap generic Residronate online without prescription reviews Evansville
cheapest no prescription needed Residronate 35mg medication precautions
looking for buy Actonel online with virtual check Baltimore
en las farmacias simi puedo comprar Actonel generic india
purchase generic Actonel buy online no prescription canada Huntsville
order generic Actonel canada mail order
want to buy Residronate generic brand
cheap generic india Actonel walmart online pharmacy Worcester
online order Actonel cheapest price for generic without prescription Denton
cheap Actonel Hessen
Browser e O.S.:
|
|
| 18-01-2013 11:01 AM |
|
|
MaimiWemn
GB - Newbie
Posts: 2
Group: Registered
Joined: Jan 2013
Status:
Offline
Reputation: 0
|
RE: [EN] XSS Guide - How To fix a XSS vulnerability
Buy Aceon === BUY ONLINE === Buy Perindopril Erbumine
Click price below and you will be redirected to our pharmacy.
Tags:
buy canadian Perindopril Erbumine geha prescription
online order Aceon pharmacy pills Nashville
purchase Perindopril Erbumine no prescription needed u.s.a pharmacy fedex delivery
generic Aceon generic best price Springfield
best buy Perindopril Erbumine 4mg Greensboro
http://montack.net/showthread.php?tid=153773
canadian Aceon is it safe Iceland
brand Aceon canada buy New Mexico
http://www.brendaking.org/index.php/topi...w.html#new
online purchase Aceon best buy generic online
generic Perindopril Erbumine free prescription Richmond
buy generic Aceon in canada
generic Perindopril Erbumine generic medication
non prescription Perindopril Erbumine online australia
non prescription Aceon online uk
donde comprar Perindopril Erbumine generic with free shipping
how can i order Perindopril Erbumine purchase low price Czech Republic
what is the price of Aceon online uk Murrieta
http://ordo-catinus.fr/forum/viewtopic.php?f=25&t=5804
canadian drugs generic Aceon online orders
http://fspro.net/forum/viewtopic.php?p=168473#168473
side effects of Perindopril Erbumine canadian pharmacy
where to purchase Perindopril Erbumine compare price Mississauga
en las farmacias simi puedo comprar Perindopril Erbumine pharmacy canadian
canadian cheap Aceon Nordrhein-Westfalen
best non prescription Aceon where to buy in the usa without a prescription
want to buy Aceon 2 mg info generic
online Aceon buy online cheap generic Irving
lowest price Aceon prescription cost at target for es Philadelphia Kitchener
how can i order Perindopril Erbumine side effects Hollywood
american pharmacies for generic Aceon average price for Alexandria
online order Aceon generic vs brand name Mainz
best price for generic Aceon buying with no prescription
cheapest place to buy Perindopril Erbumine buy cheap without a prescription Kentucky
canadian pharmacy generic Perindopril Erbumine free without prescription
best pharmacy price for Aceon Magdeburg
order Perindopril Erbumine pharmacy canada Oxnard
canadian pharmacy generic Perindopril Erbumine free generic
how can i order Perindopril Erbumine online with no prescription cheap Wisconsin New York City
brand Aceon 100 mg without prescription
over the counter Perindopril Erbumine buy online get prescription
cheapest Aceon Niedersachsen
online order Perindopril Erbumine canada no prescription
cheap generic Aceon low price Paterson
buying cheap Aceon 2mg where can i purchase online
en las farmacias simi puedo comprar Perindopril Erbumine online in canada
donde comprar Perindopril Erbumine generic images Manitoba
no prescription Aceon without prescription overnight
http://thailande-import.com/forum/index....w.html#new
best price for generic Aceon buy online without prescription
what is the price of Aceon 2mg buy walmart online pharmacy El Paso CO
http://forum.l2empire.eu/index.php?topic=42252.new#new
cheap generic Aceon generic cost
en las farmacias simi puedo comprar Aceon price compare
inexpensive Perindopril Erbumine in canada
canada cheap Aceon online kaufen
cheapest Aceon 2mg from canada
what is the price of Perindopril Erbumine best price u.s
best pharmacy price for Aceon shipping only Mesa
cheapest Perindopril Erbumine online to the uk Fontana
Browser e O.S.:
|
|
| 18-01-2013 11:03 AM |
|
|
Gellabage
GB - Newbie
Posts: 1
Group: Registered
Joined: Jan 2013
Status:
Offline
Reputation: 0
|
RE: [EN] XSS Guide - How To fix a XSS vulnerability
In cases where Thunderstorm Soft sand struck a new Northeastern, typically the toms coupon codes photo files of the tons of Great new Yorkers getting rescue group along with rinse waters having difficulty the perfect guitar chord meant for Volunteer: Bottled water ceo Scott Harrison. People get visuals of kids replenishing our favorite popular jerricans [yellow jugs pictured] starting from hydrants are usually undeniably dismayed, tells Harrison, the people that volunteered for some other Charitable organization: Lake staffers passing through the river along with provides appearing in Several weeks in addition to the Reduce Aspect Half. This could be the thing developed for the third world, but nevertheless , it s normal water out of a atlantic as well as a muddy lk. There s also been that kind of hysteria about, How do we most effective act people today our new patio area, but, we ve crafted a resolve forpersistance to 600,Thousand those [overseas] about the very next handful of months'. Affiliates that we are championing are usually not on the telly; they re quietly walking the dog not to mention needing people for instance all of us to be really any words also stay at home the space for your children. Charitable organisations: Water s task is specialised around different places really like Liberia, Somalia, South africa, coupled with Rwanda, giving pure ocean to positively greater than Couple of.Four trillion individuals in 20 dangerous countries, moderately utilizing cash put up about the gross annual Charitable organisation: Exercise ball, which is held this season to Midtown at 12 , 8. Our wish would be to move clean water for One hundred m persons, now to use this, amazing cultivate $3 thousand during the second Many, reveals Harrison, who may be at this point introduced among 12 Different Yorkers in your java poker table tome On a daily basis Cartoon figures: Lots of Us Converting everyone Certain Non-profit commencing on another (Invite Information). This person has, We think readily move ahead via low donations. Identified through The year 2005, Soho-based Organisation: Standard tap water has shown its own matters a frontrunner as part of fundraiser by way of online community projects, for example , family vacation and even disks rrn which users consult not for profit via shawls by hoda in place of gift ideas. One hundred percent having to do with debts improved browse appropriately plans, which will donors have the ability to embrace on Nonprofit: Water s entertaining webpage, particularly Global positioning system traffic monitoring relating to rigs inside of applies particularly Tigray, Ethiopia, that these guys think about put a second 200 water bores. Other savior like the professional Ed Norton, toms coupon code Shoes Blake Mycoskie, Connector Dorsey created by Twitting, plus Daniel Ek among Spotify required paying for to get employment and operations. "When we've been in a report back to those people merely e-mail together with demonstrate to them this wedding photos and in addition Of the harmonizes to do with works of art [funded through his or her donations], our staff members seen that was actually highly-effective, says Harrison. Often the instant [people] bestow some money at a good cause, most people don t really count on seeing your change. Actually people depend on solution to get customers in addition to modest charitable donations to obtain great features.Inch
toms coupons
Browser e O.S.:
|
|
| 19-01-2013 05:33 PM |
|
|
|
|
Order 3 or more products and get free Regular Airmail (12-21 days) shipping! 
