full-disclosure - Re: A technique to mitigate cookie-stealing XSS attacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.21.0211090704410.27245-100000@Tempo.Update.UU.SE>
From: ulfh at update.uu.se (Ulf Harnhammar)
Subject: Re: A technique to mitigate cookie-stealing XSS attacks

On Thu, 7 Nov 2002, Nick Simicich wrote:

> If I understand  the XSS vulnerability correctly, it is all based on the 
> ability of javascript to access cookies through the document.cookie 
> property.

No, it's not just about that. You can also include scripts that will
perform some action on your behalf, by redirecting to a script that does
something (i e, an XSS bug in a web-based Usenet client might open up the
possibility for an attacker to post to Usenet under your name).

This is done by simply including HTML code like:

<script>self.location.href="/script.cgi?param1=the&param2=blue&param3=mask"
</script>

or even:

<meta http-equiv="Refresh" content="0; URL=/script.cgi?param1=the&param2=
blue&param3=mask">

(The latter version doesn't even use JavaScript.)

To sum this all up, stating that XSS is all about JavaScript being able to
access cookies to steal someone's password is an oversimplification.

// Ulf Harnhammar
   VSU Security
   ulfh@...ate.uu.se