The SecurityQA Toolbar
will then display all security issues found from the testing. See Figure 2-5 for an
example XSS report. Notice the iSEC Test Value section that shows the speci?¬? c
request and the speci?¬? c response in boldface, which shows was string trigged
the XSS ?¬‚ aw.
Figure 2-4 SecurityQA Toolbar
52 Hacking Exposed Web 2.0
SUMMARY
A couple of security controls can be found in web browsers??”namely, the same origin
policy and the cookie security model. In addition, browser plug-ins, such as Flash Player,
Outlook Express, and Acrobat Reader, introduce more security issues and security
controls. However, these additional security controls tend to reduce to the strength of the
same origin policy if an attacker can force a user to execute JavaScript originating from a
particular domain.
Figure 2-5 Cross Site Scripting testing results from SecurityQA Toolbar
Chapter 2: Cross-Site Scripting 53
Cross-site scripting (XSS) is a technique that forces users to execute script (JavaScript,
VBScript, ActionScript, and so on) of the attacker??™s choosing on a particular domain and
on behalf of a victim. XSS requires a web application on a particular domain to serve
characters under the attacker??™s control.
Pages:
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136