What makes an input vulnerable to XSS?

Question

I've been reading about XSS and I made a simple form with a text and submit input, but when I execute <script>alert();</script> on it, nothing happens, the server gets that string and that's all.

What do I have to do for make it vulnerable?? (then I'll learn what I shouldn't do hehe)

Cheers.

Are you using any server side language? – StingyJack May 25 '10 at 18:53 — StingyJack, May 25 '10 at 18:53

score 23 · Answer 1 · answered May 25 '10 at 15:07

23

Have the server output the input back to the client.

answered May 25 '10 at 15:07

Quentin

914,110
126
1,211
1,335

2

I read "Having the server output the input back to the client.", and thought wow, that's the most simplest, and dead-on answer to this question. – K. Norbert May 25 '10 at 15:09

BalusC · Accepted Answer · 2013-05-20T16:23:14.877

Indeed just let the server output it so that the input string effectively get embedded in HTML source which get returned to the client.

PHP example:

<!doctype html>
<html lang="en">
    <head><title>XSS test</title></head>
    <body>
        <form><input type="text" name="xss"><input type="submit"></form>
        <p>Result: <?= $_GET['xss'] ?></p>
    </body>
</html>

JSP example:

<!doctype html>
<html lang="en">
    <head><title>XSS test</title></head>
    <body>
        <form><input type="text" name="xss"><input type="submit"></form>
        <p>Result: ${param.xss}</p>
    </body>
</html>

Alternatively you can redisplay the value in the input elements, that's also often seen:

<input type="text" name="xss" value="<?= $_GET['xss'] ?>">

resp.

<input type="text" name="xss" value="${param.xss}">

This way "weird" attack strings like "/><script>alert('xss')</script><br class=" will work because the server will render it after all as

<input type="text" name="xss" value=""/><script>alert('xss')</script><br class="">

XSS-prevention solutions are among others htmlspecialchars() and fn:escapeXml() for PHP and JSP respectively. Those will replace among others <, > and " by <, > and " so that enduser input doesn't end up to be literally embedded in HTML source but instead just got displayed as it was entered.

score 4 · Answer 3 · answered May 25 '10 at 15:12

4

You should "inject" the script. So if you have a text-input, you should put in the form:

" /> <script>alert();</script>

This way you first close the attribute of the existing HTML and then inject your own code. The idea is to escape out the quotes.

answered May 25 '10 at 15:12

Henri

5,065
23
24

That's not what he's asking. He knows how to perform the attack, he's asking what makes an input vulnerable. – kingsfoil Apr 26 '17 at 16:24

Annie · Answer 4 · 2017-03-27T15:12:04.413

1

Google made a really awesome tutorial that covers XSS and other security vulnerabilities here. It can help you understand how these issues are exploited in real applications.

edited Mar 27 '17 at 15:12

answered May 25 '10 at 18:57

Annie

6,621
22
27

score 1 · Answer 5 · answered May 25 '10 at 21:05

Three simple things:

If you're not outputting untrusted data to the page at some point there is no opportunity for XSS
All your untusted data (forms, querystrings, headers, etc) should be validated against a whitelist to ensure it's within an acceptable range
All your output to the screen should be endcoded with an appropriate library (ie Anti-XSS for .NET) onto the appropriate language (HTML, CSS, JS, etc).

More info with examples in OWASP Top 10 for .NET developers part 2: Cross-Site Scripting (XSS).

What makes an input vulnerable to XSS?

5 Answers5

Linked