Hello all,
Maybe someone reading this saw my previous post on nemesis use. Basically, I am working with a professor here at my university who is teaching a security course, but he has no background in linux. He is well aware of the benefits of using linux and thus, I'm trying to provide what input I can. </Background Info>

The professor would like to create an html file that has a search bar vulnerable to cross site scripting. The example he gave is having students click some link that includes:

"<SCRIPT>alert("a")</SCRIPT>

So basically, my question is three fold....

1. How do I break my Apache server to be vulnerable to a mal-formed link that will use cross-site scripting (Something only the students will be able to see)?

2. What code can I use in a simple html search page that will be susceptible to the attack?

3. How can I produce a link to use a malformed URL to exploit the vulnerability in my Apache setup in order to execute something simple like "alert("a")", without the URL being modified to exclude special characters("<>)???

He needs this before the end of the week and my background with html is pretty limited, so if anyone with experience in security/html/webserver could provide any suggestions, I would really appreciate it! Thanks very much in advance!

First of all, cross-site scripting (XSS) or Code Injection is a client side vulnerability and not a server side vulnerability. that is to say that XSS does not affect web applications servers directly. Rather, XSS attacks attempt so steal logged users credentials (session id...usually stored in cookies) and store this information on a remote server (sometimes referred to as black hat server)...where an attacker or malice user, would use this information to fool the web server (be it Apache, IIS, Tomcat...etc) that they are a subscribed user or the user who's login credentials were stolen.

Therefore, the damages that can be caused to the web application very much depend on the role(s) that user have...and does not affect web server directly.

For more information on XSS attacks, please see the following URLs

http://www.owasp.org/index.php/Cross_Site_Scripting
http://ha.ckers.org/cross-site-scripting.html

So, does this type of attack only affect Linux machines? the answer is no. It affects windows, Mac OS, and Unix users, and just about any web server such as IIS, Tomcat, Apache...etc.

How can you prevent this type of attack?
There are many ways to prevent this type of attack, one of them is not to allow users to submit data in the first place. another is to prevent users from entering any none-English characters in forms etc. another is to encode output...etc.

cheers,
Ess