Hello, and welcome back.
In this next series of lessons,
we're going to talk about cross-site scripting.
The way we're going to chat about it is, first,
we're going to recap the idea behind injection attacks.
Then I'm going to briefly
introduce what cross-site scripting is,
and we're going to have a look
at the concept tree for cross-site scripting.
Then from there, we're going to
talk about some browser fundamentals.
After this lesson, you'll be able to
identify what is cross-site scripting.
Now, let's get started. Remember that we said
that in general an injection attack allows an attacker to
input untrusted data into some command which
the interpreter of the program
interprets completely as a command.
Here, I have an example of modifying
the Document Object Model of a document,
and including a user-defined parameter.
If you're not really familiar with the DOM,
we're going to talk about that a little bit later.
As you can see, a malicious attacker could give
an unsuspecting client this URL to click on.
As you can see,
there's some JavaScript in this URL.
Because this particular web application
is vulnerable to cross-site scripting,
what happens is that this parameter here,
this JavaScript is actually placed within
the document object model of
what this vulnerable client is looking at.
What the actual code looks like is,
it takes the contents of parameter p and
adds it within the document that the client then renders.
The result is that this JavaScript is
injected within the document
that the browser is looking at.
Because of that, during the rendering process,
the browser interpreter
will interpret justice JavaScript,
and actually run this script.
You will see an alert box pop up.
In general, there is a mismatch
between how the developer sees a string
coming into the interpreter and
how the interpreter sees this string.
This string being fed into the interpreter is considered
by the interpreter as 100 percent a command.
However, it is treated programmatically
by the developer as part data and part command.
On top of that, the string is
modifiable by an untrusted party.
To give you a brief description
of what cross-site scripting is.
It is the ability to inject
JavaScript into a web application such that
the client or the browser that's viewing
the document then runs the malicious JavaScript.
This can lead to
account impersonation or session stealing.
Here we have the concept tree that basically
outlines the fundamental concepts
behind cross-site scripting,
and here I've added
an asterisk for the idea of domain names.
There's a lot of really good examples or documents on
the web about the topic of domain names.
In fact, you can look this up on
Wikipedia and they have
a really good description of what domain names are.
We're going to talk first about HTTP,
and work our way up this tree.
Then talk about the DOM,
and work our way up this part of
the tree on the left-hand side,
then we'll be prepared to
talk about cross-site scripting.