How Hackers Inject malicious Code on Web Pages – 1

There are mainly 3 Types of XSS Vulnerabilities code hackers use, Though there may be more but there are 3 specific ones namely:

*Reflected XSS
*DOM Based XSS
*Stored XSS.

REFLECTED XSS

Reflected Cross-Site Scripting (XSS) is a common web security vulnerability that occurs when an attacker injects malicious code into a web application, which then gets reflected back to the user’s browser. Unlike stored XSS, where the payload is stored on the server-side, in reflected XSS, the payload is included in the HTTP response directly from the server.

Here’s how reflected XSS typically works:

1. Injection Point: The attacker identifies a vulnerable input field or parameter within the web application, such as a search box, login form, or URL parameter, where user input is not properly validated or sanitized.
2. Malicious Payload: The attacker crafts a malicious payload, usually in the form of JavaScript code, and submits it through the vulnerable input field as part of the HTTP request. For example, the payload could be included in the URL of a link or in the body of a form submission.
3. Server Processing: The web server receives the malicious input and includes it in the HTTP response generated for the user’s request. This response may contain HTML or JavaScript code that includes the injected payload.
4. Execution: When the victim visits a page containing the reflected XSS vulnerability, the injected payload is executed within the context of their browser. This allows the attacker to perform various malicious actions, such as stealing session cookies, redirecting the user to phishing pages, or defacing the website.

Reflected XSS vulnerabilities can have serious consequences, including:

• Session Hijacking: Attackers can steal session cookies or credentials from authenticated users, allowing them to impersonate the victim and perform unauthorized actions.
• Phishing Attacks: Attackers can craft convincing phishing links that prompt users to enter their credentials or other sensitive information.
• Client-Side Exploitation: Attackers can exploit vulnerabilities in the victim’s browser or plugins to further compromise their system.

To prevent reflected XSS vulnerabilities, web developers should implement proper input validation and output encoding techniques:

• Input Validation: Validate and sanitize all user-supplied input before processing it on the server-side. Use whitelisting or strict input validation to only allow known safe input formats.
• Output Encoding: Encode all user-generated content before including it in the HTML response. This includes HTML encoding, JavaScript encoding, and URL encoding to prevent script execution.

Regular security reviews and automated vulnerability scanning can also help identify and remediate reflected XSS vulnerabilities in web applications, ensuring the safety and security of users’ data and systems.

STORED XSS

Stored Cross-Site Scripting (XSS) is a type of security vulnerability commonly found in web applications. Unlike reflected XSS, where the malicious script is reflected off the web server, stored XSS occurs when an attacker injects malicious scripts or payloads directly into a vulnerable web application’s database or storage.

Here’s how stored XSS typically works:

1. Injection Point: The attacker identifies a user input field within the web application where input is not properly sanitized or validated. This could be a comment section, message board, user profile, or any other form field that allows user-generated content to be stored.
2. Malicious Payload: The attacker crafts a malicious payload, usually JavaScript code, and submits it through the vulnerable input field. This payload is then stored on the server-side, often in a database, without proper sanitization.
3. Execution: Whenever a victim visits the affected page containing the stored payload, the malicious script is served from the server-side along with the legitimate content of the page. As a result, the attacker’s script executes within the context of the victim’s browser, allowing them to perform various malicious actions.

Stored XSS vulnerabilities can have severe consequences, including:

• Session Hijacking: Attackers can steal session cookies or credentials from authenticated users, allowing them to impersonate the victim and perform unauthorized actions.
• Data Theft: Attackers can exfiltrate sensitive user data, such as personal information, financial details, or private messages.
• Phishing Attacks: Attackers can craft convincing phishing pages that prompt users to enter their credentials or other sensitive information.

To prevent stored XSS vulnerabilities, web developers should implement proper input validation and output encoding techniques:

• Input Validation: Validate and sanitize all user-supplied input before accepting and storing it in the database. Use whitelisting or strict input validation to only allow known safe input formats.
• Output Encoding: Encode all user-generated content before displaying it to users. This includes HTML encoding, JavaScript encoding, and URL encoding to prevent script execution.

Regular security audits and penetration testing can also help identify and remediate stored XSS vulnerabilities in web applications, ensuring the safety and security of user data.

DOM BASED XSS

DOM Based Cross-Site Scripting (XSS) is a type of security vulnerability that occurs when client-side JavaScript code dynamically updates the Document Object Model (DOM) based on user-controlled input, leading to the execution of malicious scripts in the victim’s browser.

Here’s how DOM Based XSS typically works:

1. Injection Point: The attacker identifies a web application that dynamically updates the DOM based on user input, such as a search query or URL parameter. This input is reflected in the page content without proper validation or sanitization.
2. Malicious Payload: The attacker crafts a malicious payload, usually JavaScript code, and injects it into the vulnerable input field. For example, the payload could be included in the URL of a link or in the body of a form submission.
3. Client-Side Execution: When the victim interacts with the vulnerable web page, the injected payload is executed within the context of their browser. Since the payload is processed client-side, traditional server-side security controls such as input validation and output encoding may not be effective in preventing the attack.
4. Impact: The attacker’s script can access sensitive information, such as cookies or session tokens, and perform actions on behalf of the victim, such as stealing credentials or executing unauthorized transactions.

To prevent DOM Based XSS vulnerabilities, web developers should implement proper input validation and output encoding techniques:

• Input Validation: Validate and sanitize all user-supplied input before using it to update the DOM. Ensure that input is restricted to expected formats and does not contain executable code.
• Output Encoding: Encode all user-generated content before including it in the DOM. Use JavaScript encoding or contextual encoding based on the context in which the data is rendered to prevent script execution.

Additionally, developers should avoid relying solely on client-side JavaScript for security controls and consider implementing server-side validation and authorization checks to prevent unauthorized access and data manipulation.

Regular security reviews and penetration testing can also help identify and remediate DOM Based XSS vulnerabilities in web applications, ensuring the safety and security of users’ data and systems.