preview

XSS Software Analysis

Good Essays
Open Document

In figure 3 the attacker adds the following code in the legitimate site. Because the site is not protected by XSS scripting, it allows the attacker to do it. (-- removed HTML --) (“body”).empty(); (“body”).css(“background”,”red”); (“body”).append(“ (-- removed HTML --) “You have been hacked” (-- removed HTML --) ”); (“body”).append(“ (-- removed HTML --) “You have been hacked” (-- removed HTML --) ”); (“body”).append(“ (-- removed HTML --) “You have been hacked” (-- removed HTML --) ”); (“body”).append(“ (-- removed HTML --) “You have been hacked” (-- removed HTML --) ”); (“body”).append(“ (-- removed HTML --) “You have been hacked” (-- removed HTML --) ”); (“body”).append(“ (-- removed HTML --) “You have been hacked” (-- removed …show more content…

Some of the famous XSS attacks were done on PayPal, MySpace and BBC. 5. How to stop XSS attack: XSS has a big impact on different websites. The type of attacks that can be done using XSS has a wide range. Using XSS an attacker can do the following things: 1) Hack User Accounts 2) Hack Admin Accounts 3) Identity theft. Also, it is very difficult to track the origin of attack and to know that an attack has happened. The attack can be found when the user contacts the site after the attack or if the website occasionally checks for some miscellaneous code in their database. There are some suggested ways to stop an XSS attack, below are some of them. Don’t allow HTML tags: To make the code works there needs to be HTML tags like (-- removed HTML --) (-- removed HTML --) in the input given by the attacker on the legitimate site. One way to stop an XSS attack is to simply don’t allow these tags in the input. When the tags are not present in the input by the attacker, the code won’t run on the user browser and the attacker cannot do anything. But this can cause some harm for the user experience because in some cases the website requires some of these tags. Allow Safe tags only. The other thing to do can be to allow only safe tags instead of blocking all kinds of tags. This can be difficult to define in some

Get Access
Related
Get Access