Please enable JavaScript.
Coggle requires JavaScript to display documents.
:!:XSS:!: (:forbidden:Prevent (RULE #0 :check: Never Insert Untrusted Data…
:!:XSS:!:
:forbidden:Prevent
RULE #0 :check: Never Insert Untrusted Data Except in Allowed Locations
RULE #1 :check: HTML Escape Before Inserting Untrusted Data into HTML Element Content
RULE #2 :check: Attribute Escape Before Inserting Untrusted Data into HTML Common Attributes
RULE #3 :check: JavaScript Escape Before Inserting Untrusted Data into JavaScript Data Values
...(cheat sheets)
ECCS
RULE #2
http://eccs-1605.vs2.deepsoft.co.jp/cgi-bin/composer.cgi?to=a%22onmouseover=alert(1)//%22
RULE #2
http://example.com/some-funny-url'+alert(1);/
Untrusted Data
EML
Monitor >> Queue
Stat/List >> list
Mail List
Mil View / Mail Write
Header
Attachment
Body
option::tag_view=1
text body
html body
option::tag_view=0
text body
html body :star:
SPEC:question:
meta
xmeta
body
xbody
script
comment out <!--script>xxxx</script-->
style
remove element
javascript
javascript :red_cross:
xmp
<xmp
embed
xembed
COMMAND
Monitor >> Log
XSS vs CSRF
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.
Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.
:explode: ByPass
https://gist.github.com/rvrsh3ll/09a8b933291f9f98e8ec
RULE #1
:forbidden:
:forbidden:
:forbidden:
:forbidden:
:forbidden:
:forbidden:
:forbidden:
:forbidden:
:forbidden:
XSS Evation
HTML parsing
RULE
[tag.replace]
body
link
frame
embed
param
meta
base
[tag.remove]
style
frameset
iframe
script
applet
object
[attribute.replace]
onclick
onmouseover
71 event attributes...
[attribute.replace.has_value]
href=javascript
src=javascript
local/db/xss_rules.dat (INI format)
:question:
INI
XML
JSON
YAML
TOML
96 case :!:
html entity number :question:
invalid format :question:
全顧客のパッチが必要
最大限の仕様を維持
「修正/テスト」に負荷があってはならない
関連の問題が追加に発生した場合、パッチなしで対応可能
improvement