LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-28-2007, 11:42 AM   #1
illiadum
Member
 
Registered: May 2006
Location: Arizona...where its unreasonably hot.
Distribution: Slackware
Posts: 34

Rep: Reputation: 15
Cross Site Scripting - Apache


Hello all,
Maybe someone reading this saw my previous post on nemesis use. Basically, I am working with a professor here at my university who is teaching a security course, but he has no background in linux. He is well aware of the benefits of using linux and thus, I'm trying to provide what input I can. </Background Info>

The professor would like to create an html file that has a search bar vulnerable to cross site scripting. The example he gave is having students click some link that includes:

"<SCRIPT>alert("a")</SCRIPT>

So basically, my question is three fold....

1. How do I break my Apache server to be vulnerable to a mal-formed link that will use cross-site scripting (Something only the students will be able to see)?

2. What code can I use in a simple html search page that will be susceptible to the attack?

3. How can I produce a link to use a malformed URL to exploit the vulnerability in my Apache setup in order to execute something simple like "alert("a")", without the URL being modified to exclude special characters("<>)???

He needs this before the end of the week and my background with html is pretty limited, so if anyone with experience in security/html/webserver could provide any suggestions, I would really appreciate it! Thanks very much in advance!
 
Old 08-28-2007, 02:26 PM   #2
ess
LQ Newbie
 
Registered: Aug 2007
Posts: 5

Rep: Reputation: 0
First of all, cross-site scripting (XSS) or Code Injection is a client side vulnerability and not a server side vulnerability. that is to say that XSS does not affect web applications servers directly. Rather, XSS attacks attempt so steal logged users credentials (session id...usually stored in cookies) and store this information on a remote server (sometimes referred to as black hat server)...where an attacker or malice user, would use this information to fool the web server (be it Apache, IIS, Tomcat...etc) that they are a subscribed user or the user who's login credentials were stolen.

Therefore, the damages that can be caused to the web application very much depend on the role(s) that user have...and does not affect web server directly.

For more information on XSS attacks, please see the following URLs

http://www.owasp.org/index.php/Cross_Site_Scripting
http://ha.ckers.org/cross-site-scripting.html

So, does this type of attack only affect Linux machines? the answer is no. It affects windows, Mac OS, and Unix users, and just about any web server such as IIS, Tomcat, Apache...etc.

How can you prevent this type of attack?
There are many ways to prevent this type of attack, one of them is not to allow users to submit data in the first place. another is to prevent users from entering any none-English characters in forms etc. another is to encode output...etc.

cheers,
Ess

Last edited by ess; 08-28-2007 at 02:30 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
making apache site public armchair rambo Linux - Networking 6 09-01-2006 12:42 PM
apache web site pinguim66 Ubuntu 13 08-20-2006 12:40 AM
LXer: Title: phpLDAPadmin Cross-Site Scripting and Script Insertion LXer Syndicated Linux News 0 04-26-2006 05:54 PM
Put a site in apache how? hraposo Debian 5 11-26-2004 11:26 AM
cross site scripting - best method? lunardreamr Programming 1 09-26-2003 12:18 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 07:59 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration