Penetration Testing mailing list archives
Testing for DOM-Based XSS....input requested
From: Joseph McCray <joe () learnsecurityonline com>
Date: Sat, 23 Aug 2008 17:32:36 -0400
I got into to this discussion yesterday with someone about DOM-Based XSS. It got me thinking about how you could programmatically test for it. I'm really having a tough time with it. I'm hoping someone can shed some light on it, and hopefully if I can understand it better I can write some sort of check to actually test for it. According to Wikipedia: ======================================================================= With DOM-based cross-site scripting vulnerabilities, the problem exists within a page's client-side script itself. For instance, if a piece of JavaScript accesses a URL request parameter and uses this information to write some HTML to its own page, and this information is not encoded using HTML entities, an XSS hole will likely be present, since this written data will be re-interpreted by browsers as HTML which could include additional client-side script. ======================================================================= So does that mean I'd have to monitor all GET/POST requests made to the server, and their related responses to see if a string from the REQUEST could be found in the response? Does anyone have any code snippets I could look at, or at least some conceptual guidance they can give me? Thanks in advance, -- Joe McCray Toll Free: 1-866-892-2132 Email: joe () learnsecurityonline com Web: https://www.learnsecurityonline.com Learn Security Online, Inc. * Security Games * Simulators * Challenge Servers * Courses * Hacking Competitions * Hacklab Access "The only thing worse than training good employees and losing them is NOT training your employees and keeping them." - Zig Ziglar ------------------------------------------------------------------------ This list is sponsored by: Cenzic Top 5 Common Mistakes in Securing Web Applications Get 45 Min Video and PPT Slides www.cenzic.com/landing/securityfocus/hackinar ------------------------------------------------------------------------
Current thread:
- Testing for DOM-Based XSS....input requested Joseph McCray (Aug 25)
- Re: Testing for DOM-Based XSS....input requested Tim (Aug 25)
- Re: Testing for DOM-Based XSS....input requested bugtraq (Aug 25)
- <Possible follow-ups>
- Re: Testing for DOM-Based XSS....input requested Christian Eric EDJENGUELE (Aug 25)
- Re: Testing for DOM-Based XSS....input requested Christian Eric EDJENGUELE (Aug 25)