Instructor: Now let's talk about 2 2
how we can prevent XSS vulnerabilities. 3 3
The way these vulnerabilities happen is because 4 4
whenever a user enters something into a text box 5 5
or into a parameter, that input is displayed into the HTML 6 6
so it's treated as if it's part of the page and therefore 7 7
if there is JavaScript in it, the code is being executed. 8 8
So, to prevent this exploit, the best thing to do is to try 9 9
and minimize the usage of untrusted inputs 10 10
so any time a user inputs something or any time 11 11
something is input from parameters, try to minimize that. 12 12
Also, make sure that you always escape whatever that's going 13 13
to be displayed or used into the HTML page 14 14
because XSS cannot only be injected into places 15 15
where the things are displayed on the page 16 16
but it can also be injected into parameters 17 17
of certain elements of the HTML page. 18 18
So what I mean by escaping is converting 19 19
each of these characters to what 20 20
they would be represented by in HTML. 21 21
You can do that using scripts and you can do that 22 22
using your own script. 23 23
Now let me show you how this happens. 24 24
Now, I'm here at my Vulnerable web page that we were using 25 25
and I'm gonna go to the stored one and obvious (talks) 26 26
can see that every time we click on that, the XSS runs. 27 27
So let's inspect this element. 28 28
Now this element is where we injected our alert 29 29
and if we right click and go on inspect element, 30 30
it will show us the HTML of this page or the HTMl 31 31
of this particular element right here highlighted. 32 32
So I'm gonna make this bigger. 33 33
And if we look at it right here, 34 34
you'll see that we have the name and that's Zaid 35 35
and then the other input which is the message, 36 36
it's a script and the script (talks) the script does, 37 37
it does alert XSS so it's exactly what we injected 38 38
into it when we did the comment. 39 39
So every time we run this page, 40 40
this piece of code is executed. 41 41
So we need to do is we need to make sure every time 42 42
a user enters something and that something will be displayed 43 43
on a page or that something would be used somewhere 44 44
in the element so even the id here or even the H, 45 45
the id is just, for example is a parameter of the div, 46 46
it's not displayed, you never see this id 47 47
but this can be injected as well. 48 48
So hackers can actually try to inject stuff 49 49
into the parameters, they can try to inject stuff 50 50
into the image attributes for example, 51 51
they can do an image and inject stuff into the source 52 52
or into the URL. 53 53
So this is just an example here and every time 54 54
a user's input is going to be used anywhere on the page 55 55
so even if you don't see it, if you usually don't see it, 56 56
you need to make sure that you escape that input 57 57
and make sure that it does not contain any code 58 58
and if it contains any code then it's converted 59 59
to an equivalent that the code will not be running 60 60
so it's converted to its http equivalent so that 61 61
you'll actually, once you escape this, 62 62
you will actually see this in the message 63 63
so you'll see the message as script alert XSS 64 64
but it will never be executed, 65 65
this script will never actually be executed 66 66
on the target person when they run it. 67 67
Now, as a user, to prevent yourself from being used 68 68
into an XSS attack, now the URL coming to you 69 69
will probably look like a URL of a trusted website 70 70
for example let's assume that you work in a company 71 71
and there was an XSS in your company 72 72
and you are logging in to your company 73 73
and the code gets executed on you, 74 74
then there isn't much you can do yourself 75 75
but you need to be careful. 76 76
So with BeEF we saw in order to exploit the vulnerabilities, 77 77
we were showing for example a fake update, 78 78
so make sure when you, if you get a message always 79 79
that there's an update, make sure you actually go 80 80
to the website that provides that application 81 81
so if Firefox said that there's an update, 82 82
go to the website of Firefox and see if 83 83
there is actually an update and if there is, 84 84
download it from that website, don't download it 85 85
from the notification that you got. 86 86
Also, make sure you're downloading it from a https website 87 87
and once you download it, you can inspect it and check it 88 88
the same way that we've seen before to make sure that 89 89
there's no backdoors or anything in it. 90 90
You can also check the md5sum to make sure that the file 91 91
hasn't been manipulated while it was being downloaded. 92 92
The same when we did the fake Facebook login 93 93
when you were with BeEF so what you can do is 94 94
whenever you're told that you got logged out 95 95
and please log back in, again, ignore that, 96 96
go to facebook.com, make sure it's going through https 97 97
and then log in to Facebook. 98 98
So always try to be careful with notifications popping up 99 99
telling you you need to do stuff. 100 100
Always be wary and never trust them.