Freelance Web Developer & Freelance Web Developer London & Freelance Web Developer United Kingdom

In this tutorial I will explain what Cross-site scripting (XSS) is. I will then develop a basic article application with a commenting system that is vulnerable to an XSS attack in order to demonstrate how to carry it out, and how to effectively prevent against this critical security threat using PHP.

Transcript:

Hi there I’m Abdi Gulaid an experienced freelance web developer at BestCoder.co.uk. I've put this video together in order to explain demonstrate, and show you how to prevent against XSS attacks when developing websites for the web. If you are an experienced or a novice web developer and want to learn how to make your clients websites more secure then this video tutorial is for you.

This video will be as clear and as concise as possible in order to help you learn. In this tutorial I will explain what an XSS attack is. I'll then quickly hand code a dummy PHP application that we'll use as a test bed to demonstrate an XSS attack. Once we do this we'll then go through the steps in how to prevent against an XSS attack.

So what is XSS you ask?

XSS is short for Cross-site scripting. XSS is a security vulnerability that is found in poorly developed web applications that allow for malicious attackers to inject client side scripts such as JavaScript within actual web pages. XSS attacks are common and account for nearly three quarters of all website attacks in 2007 according to statistics published by Symantec.

XSS attacks have been around since the dawn of the web, and large web companies haven't been immune to XSS attacks. Companies that have been hit include but are not limited to: Google, Yahoo, Facebook, and Twitter.

Preventing against XSS attacks for your clients is critical during the web development process and it’s the first and most likely attack a hacker will attempt to carry out on a website. Good web developers understand the importance of this. To demonstrate XSS I’m now going to develop a small web application. It will be a simple article web page that allows for people to leave comments, I'll write it in PHP as it's the most common web language, and we'll use MySQL as the database to store the comments.

Right our basic PHP application is now complete. Before I demonstrate how an XSS attack works and how you can prevent against one let me explain the two types of XSS attacks. XSS attacks come in two variants: there's the non persistent type, this is the most common variant. The XSS code is injected directly into the website's URL, an attacker will have to explicitly get someone to use the compromised URL in order to carry out this attack. Hackers typically distribute the URL via email or other method in order to carry this attack.

Then there is the persistent variant, this is less common but far more dangerous. The code is injected permanently injected into the webpage, which is then repeatedly served to all visitors of that webpage.

Ok, now let’s demonstrate a non persistent XSS attack. As mentioned a moment ago, non persistent XSS attacks usually involve injecting code within the website's URL, I've made our dummy application deliberately vulnerable to this type of attack in order to show you how it’s done. To demonstrate this we'll inject a simple JavaScript alert into the website URL, our app uses the GET method to receive data stored in the URL, and anything after the equals sign will be written into the page by our PHP script. We'll deliberately write our JavaScript alert after the equals sign.

I'll now visit this compromised link, our JavaScript alert should execute as soon as the page loads. As you can see the JavaScript that we've placed in the URL has been executed, this is a successful non persistent XSS attack. A simple alert won't do much harm but an attacker will typically inject code that will download an external script that will do far more damage. These larger payloads can be programmed to steal cookie information and even personal information stored on the website. As this is a non persistent XSS attack, an attacker will have to distribute the actual URL and get someone to visit the compromised link in order to initiate an attack.

Ok, that's the non persistent attack type demonstrated. Now let's demonstrate the persistent attack variant. I've made our application susceptible to this in the comments section; again we'll simply inject a JavaScript alert into our comment in order to demonstrate the attack.

As you can see our script has been executed, and we can now see the alert. This attack type is different in that the script has been permanently stored in the database, and this script will execute every time this page is visited for as long as the script remains in the database. Again a simple JavaScript alert is harmless, but an attacker will typically inject code that will download a larger external script, that will cause far more damage.

That’s the two attack types demonstrated; now let’s look at the ways in which we can prevent against them. Always validate user input and never trust user submitted data, if you are expecting numbers, validate for number only in your code and reject data that doesn't conform to the expected data type. Secondly, always sanitise user input before storing the data in a database and always sanitise GET variables before carrying out a query or displaying the search term for instance.

I'll now demonstrate how to do this in our dummy app, the GET URL variable is currently displayed without any sanitisation, and any code that is injected will be executed by the web browser. We've already seen how dangerous this can be, fortunately PHP has a few built in functions that can be used to sanitise data, and HTMLENTITIES is one of those functions. We'll use this function to convert all submitted special characters to their HTML equivalents. We'll encapsulate our GET URL variable within a HTML entities function in order to do this. That’s now done; let’s now test the page again in order to see if the JavaScript code has been sanitised. Great as you can see the XSS attack has failed we have successfully sanitised the URL injection. Let’s view the source code to see how this has been done; we can now see that nearly all of the injected special characters have been converted into their HTML equivalents as a result this script will fail to load.

Ok, now let’s demonstrate how to prevent against the persistent attack type in our comments section. As you can see, our PHP code for storing the comments has no sanitisation whatsoever, we'll simple enclose both the name and the comments variable within the built in HTML entities function in order to sanitise the data before it gets stored in the database. Ok that's now done so let’s check to see if we can carry out an XSS attack within our comments section. As you can see the XSS attack has not been executed and the injected code has in fact been sanitised.

Let’s view the source code to see the sanitised comment; the HTMLENTITIES function has converted nearly all of the injected special characters into their HTML equivalents. This is exactly what we wanted, as a result our attempted XSS attack has failed to execute.

That's XSS explained and demonstrate you should now know how to carry out and prevent against XSS in order to make your clients websites more secure. Thanks for watching and if you like my videos don't forget to subscribe.