Top 10 2013-A3-Cross-Site Scripting (XSS) - OWASP
Learn about OWASP Top 10 2013-A3 Cross-Site Scripting (XSS) vulnerability, its impact, prevention measures, and example attack scenarios.
Overview
This is a page about the OWASP Top 10 2013-A3 Cross-Site Scripting (XSS) vulnerability. It provides information about the threat agents, attack vectors, security weakness, technical impacts, and business impacts of XSS attacks. It also explains how to prevent XSS attacks and provides example attack scenarios. The page is a part of the OWASP Foundation Wiki, but it is no longer accepting account requests.
Description
This page provides an overview of the OWASP Top 10 2013-A3 Cross-Site Scripting (XSS) vulnerability. It explains what XSS is, how it occurs, and the different types of XSS flaws. It also discusses the prevalence of XSS flaws and their impact on web applications. The page highlights the importance of preventing XSS and provides recommendations on how to prevent it. Additionally, it includes an example attack scenario that demonstrates how an XSS attack can be executed and the potential consequences of such an attack. The page references other resources and tools that provide further information on XSS prevention and detection.
How to Prevent ?
To prevent XSS, it is important to separate untrusted data from active browser content. The preferred option is to properly escape all untrusted data based on the HTML context that the data will be placed into. Positive or 'whitelist' server-side input validation is also recommended, but it is not a complete defense. Rich content can be protected by using auto-sanitization libraries like OWASP's AntiSamy or the Java HTML Sanitizer Project. Content Security Policy (CSP) can be implemented to defend against XSS across the entire site.
Example Attack Scenarios:
Attacker hijacks user sessions: The attacker modifies a parameter in the browser to execute a script that redirects the victim's session ID to the attacker's website. This allows the attacker to hijack the user's current session and potentially perform unauthorized actions.
Defeating CSRF defenses: Attackers can use XSS to defeat any automated Cross-Site Request Forgery (CSRF) defense mechanisms implemented by the application, compromising the security of the application.