Zaid: Now let's talk about
how we can prevent XSS vulnerabilities.
The way these vulnerabilities happen is
because whenever a user enters something
into a text box
or into a parameter,
that input is displayed into the HTML.
So it's treated as if it's part of the page,
and therefore, if there is JavaScript in it,
the code is being executed.
So, to prevent this exploit,
the best thing to do is to try
and minimize the usage of untrusted input.
So anytime a user inputs something
or anytime something's input from parameters,
try to minimize that.
Also, make sure
that you always escape whatever
that's going to be displayed
or used into the HTML page,
because XSS can not only be injected
into places where things are displayed on the page,
but it can also be injected into parameters
of certain elements of the HTML page.
So what I mean by escaping is
converting each of these characters to
what they would be represented by in HTML.
You can do that using scripts,
and you can do that using your own script.
Now, let me show you how this happens.
Now I'm here at my vulnerable webpage
that we were using,
and I'm gonna go to the storage one.
And obviously you can see
that every time we click on that, the XSS runs.
So let's inspect this element.
Now this element is where we injected our alert.
And if we right click
and go on inspect element,
it will show us the HTML of this page,
or the HTML of this particular element right here,
highlighted.
So I'm gonna make this bigger.
And if we look at it right here, you'll see
that we have the name,
and that's Zaid.
And then the other input, which is the message,
it's a script,
and the script what the script does
it does alert exercise.
So it's exactly what we injected into it
when we did the comment.
So every time we were on this page,
this piece of code is executed
So what we need to do is
we need to make sure every time a user enters something
and that something will be displayed on a page,
or that something will be used somewhere in the elements.
So even the ID here
or even the H, the ID is just, for example,
is a parameter of the div,
it's not displayed, you never see this ID,
but this can be injectable, can be injected as well.
So hackers can actually try to inject stuff
into the parameters, they can try to inject stuff
into the image attributes, for example,
they can do an image
and inject stuff into the source
or into the URL.
So this is just an example here.
And every time users input is going to be used
anywhere on the page, so even if you don't see it,
if you usually don't see it, you need to make sure
that you escape that input
and make sure
that it does not contain any code,
and if it contains any code
that it's converted to an equivalent
that the code will not be running.
So it's converted to its HTTP equivalent,
so that you'll actually, once you escape this,
you'll actually see this in the message.
So you see the message as script alert XSS,
but it will never be executed.
This script will never actually be executed
on the target person when they run it.
Now as a user, to prevent yourself
from being used into an XSS attack.
Now, the URL coming to you will probably
look like a URL of a trusted website, for example,
let's assume
that you work in a company
and there was an XSS in your company,
and you are logging into your company
and the code gets executed on you,
then there isn't much you can do yourself.
But, you need to be careful.
So with BeEF, we saw in order to exploit
the vulnerabilities, we were showing, for example,
a fake update.
So make sure when you, if you get a message always
that there is an update,
make sure you actually go to the website
that provides that application.
So if Firefox said
that there's an update, go to the website of Firefox
and see if there is actually an update.
And if there is, download it from that website,
don't download it from the notification that you got.
Also make sure you're downloading it from an HTTPS website.
And once you download it, you can inspect it
and check it the same way
that we've seen before to make sure
that there is no backdoors or anything in it.
You can also check the md5sum, to make sure
that the file hasn't been manipulated
while it was being downloaded.
The same when we did the fake Facebook login
when you are with BeEF, so what you can do is
whenever you're told
that you got logged out, please log back in,
again, ignore that.
Go to facebook.com, make sure it's going through HTTPS,
and then log in to Facebook.
So, always try to be careful with notifications popping up
telling you you need to do stuff.
Always be wary
and never trust them.